@fjall/util 38.0.0 → 39.0.1

package/dist/.minified

@@ -1 +1 @@
-136 files minified at 2026-09-18T21:39:28.638Z
+139 files minified at 2026-09-24T08:30:38.357Z

package/dist/aws/index.d.ts

@@ -7,6 +7,6 @@ export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./fai
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_ALIAS_TAG_KEY, KMS_RETENTION_TAG_KEY, S3_BACKUP_EXEMPT_TAG_KEY, S3_BACKUP_EXEMPTIONS, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3BackupExemption, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as S,CommandError as t,isAWSError as O,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{AWS_RESOURCE_TYPES as C,isAwsResourceType as I}from"./resourceTypes.js";import{countResourceProgress as m,formatElapsed as L}from"./deployProgress.js";import{CloudFormationFailureAnalyser as P}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as F}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as M,findCurrentOperationStart as G,isDriftSuspectReason as Y,isOperationOpeningEvent as U}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as D}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as v,FJALL_RESOURCE_TYPES as V,KMS_ALIAS_TAG_KEY as W,KMS_RETENTION_TAG_KEY as h,S3_VERSIONING_EXEMPT_TAG_KEY as k,S3_VERSIONING_EXEMPTIONS as J,SDK_PRE_EMPTY_TAG_KEY as X}from"./infraTags.js";import{COST_ALLOCATION_TAGS as z,DEFAULT_COST_ALLOCATION_ENVIRONMENT as H,DEFAULT_COST_ALLOCATION_OWNER as b,ecrCreateRepositoryTags as j,rdsPreMigrationSnapshotTags as q}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as Q}from"./monitoringRole.js";export{Q as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,C as AWS_RESOURCE_TYPES,n as CDK_NO_STACKS_MATCH,z as COST_ALLOCATION_TAGS,P as CloudFormationFailureAnalyser,t as CommandError,H as DEFAULT_COST_ALLOCATION_ENVIRONMENT,b as DEFAULT_COST_ALLOCATION_OWNER,x as FAILURE_ANALYSIS_CATEGORIES,V as FJALL_RESOURCE_TYPES,v as FJALL_RESOURCE_TYPE_TAG_KEY,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,W as KMS_ALIAS_TAG_KEY,h as KMS_RETENTION_TAG_KEY,A as MissingRegionError,e as NoRolesFoundError,S as ProfileNotFoundError,J as S3_VERSIONING_EXEMPTIONS,k as S3_VERSIONING_EXEMPT_TAG_KEY,X as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,M as classifyDriftSuspectEvents,m as countResourceProgress,j as ecrCreateRepositoryTags,G as findCurrentOperationStart,L as formatElapsed,D as formatIpamPairTagValue,O as isAWSError,I as isAwsResourceType,Y as isDriftSuspectReason,s as isNoRolesFoundError,U as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,F as maskFailureAnalysis,q as rdsPreMigrationSnapshotTags};
+import{AWSError as E,NoRolesFoundError as _,InvalidCredentialsError as e,SSOTokenExpiredError as T,MissingRegionError as A,ProfileNotFoundError as S,CommandError as O,isAWSError as t,isNoRolesFoundError as s,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as a,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{AWS_RESOURCE_TYPES as C,isAwsResourceType as I}from"./resourceTypes.js";import{countResourceProgress as m,formatElapsed as P}from"./deployProgress.js";import{CloudFormationFailureAnalyser as u}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as M}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as F,findCurrentOperationStart as G,isDriftSuspectReason as Y,isOperationOpeningEvent as U}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as D}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as v,FJALL_RESOURCE_TYPES as V,KMS_ALIAS_TAG_KEY as W,KMS_RETENTION_TAG_KEY as X,S3_BACKUP_EXEMPT_TAG_KEY as h,S3_BACKUP_EXEMPTIONS as k,S3_VERSIONING_EXEMPT_TAG_KEY as B,S3_VERSIONING_EXEMPTIONS as J,SDK_PRE_EMPTY_TAG_KEY as w}from"./infraTags.js";import{COST_ALLOCATION_TAGS as H,DEFAULT_COST_ALLOCATION_ENVIRONMENT as b,DEFAULT_COST_ALLOCATION_OWNER as j,ecrCreateRepositoryTags as q,rdsPreMigrationSnapshotTags as Q}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as $}from"./monitoringRole.js";export{$ as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,C as AWS_RESOURCE_TYPES,n as CDK_NO_STACKS_MATCH,H as COST_ALLOCATION_TAGS,u as CloudFormationFailureAnalyser,O as CommandError,b as DEFAULT_COST_ALLOCATION_ENVIRONMENT,j as DEFAULT_COST_ALLOCATION_OWNER,M as FAILURE_ANALYSIS_CATEGORIES,V as FJALL_RESOURCE_TYPES,v as FJALL_RESOURCE_TYPE_TAG_KEY,g as IPAM_OPERATIONS_POOL_TAG_KEY,e as InvalidCredentialsError,W as KMS_ALIAS_TAG_KEY,X as KMS_RETENTION_TAG_KEY,A as MissingRegionError,_ as NoRolesFoundError,S as ProfileNotFoundError,k as S3_BACKUP_EXEMPTIONS,h as S3_BACKUP_EXEMPT_TAG_KEY,J as S3_VERSIONING_EXEMPTIONS,B as S3_VERSIONING_EXEMPT_TAG_KEY,w as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,a as STACK_NOT_FOUND_PATTERN,F as classifyDriftSuspectEvents,m as countResourceProgress,q as ecrCreateRepositoryTags,G as findCurrentOperationStart,P as formatElapsed,D as formatIpamPairTagValue,t as isAWSError,I as isAwsResourceType,Y as isDriftSuspectReason,s as isNoRolesFoundError,U as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,x as maskFailureAnalysis,Q as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -66,8 +66,8 @@ export declare const KMS_ALIAS_TAG_KEY = "fjall:kms:alias";
  *
  * The literal is deployed infrastructure state: renaming the key strips every
  * already-tagged resource of its marker until the next deploy, and the posture
- * exclusion silently falls back to the legacy name patterns. The pin test in
- * `__tests__/infraTags.test.ts` guards against casual renames.
+ * exclusion then reports every role whose only exemption was the marker. The
+ * pin test in `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
 /**
@@ -77,8 +77,21 @@ export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
  * single class for every role that CloudFormation assumes only while driving a
  * custom resource (connector writers, IPAM, RDS, TLS, return-routes, identity
  * store, aws-cdk-lib's own hoisted providers), the class the unused-role
- * exclusion carves out — roles Fjall does not emit (CDK bootstrap, AWS
- * Organizations) stay on that exclusion's name patterns.
+ * exclusion carves out.
+ *
+ * What stays on that exclusion's NAME patterns is enumerated, not inferred by
+ * subtraction, and it is three sets: roles AWS or the CDK bootstrap stack
+ * create, which Fjall can never tag (`OrganizationAccountAccessRole`, the five
+ * bootstrap roles); roles Fjall emits with deterministic names that are NOT
+ * deploy-time writers (the connector deploy role, the DNS delegation roles,
+ * the dev-tier trio); and the connector writer roles
+ * (`Fjall{OIDCProvider,DeployBoundary,Callback}Lambda<orgId>`), which ARE
+ * marked — by the Quick-Create template named above — and keep a name clause
+ * only to cover connector stacks deployed before the marker release. That
+ * third set is the only LEGACY one, and the only clause that retires.
+ * aws-cdk-lib's hoisted singleton is in none of the three — it is marked, so
+ * it is exempt by marker alone, and a singleton in a stack Fjall did not
+ * synthesise carries no marker and IS reported.
  *
  * CDK resolves tag conflicts deeper-scope-wins, so a writer nested inside a
  * `vpcPeering` subtree resolves to `deployTimeWriter` — the more specific
@@ -117,3 +130,36 @@ export declare const S3_VERSIONING_EXEMPT_TAG_KEY = "fjall:s3:versioning-exempt"
 /** The exemptions the tag may carry — each names a bucket whose contents are rebuilt, not kept. */
 export declare const S3_VERSIONING_EXEMPTIONS: readonly ["build-output", "isr-cache", "cold-tier", "access-logs"];
 export type S3VersioningExemption = (typeof S3_VERSIONING_EXEMPTIONS)[number];
+/**
+ * The S3 backup-exemption marker tag — the versioning exemption's sibling, for
+ * the buckets the versioning one structurally cannot cover.
+ *
+ * `S3_VERSIONING_EXEMPT_TAG_KEY` is stamped only when the resolved `versioned`
+ * is false. These buckets are versioned and stay versioned; what they are not
+ * is a *backup source*. AWS Backup selects by tag with no resource-type
+ * filter, so a versioned bucket carrying `fjall:disasterRecovery:tier` is a
+ * bucket AWS Backup will copy — and for a bucket an AWS service delivers to
+ * continuously, that is a copy of a log stream that already has its own
+ * retention, not a recovery point anybody would restore.
+ *
+ * - Producer (`@fjall/components-infrastructure`): the `S3Bucket` wrapper
+ *   (`storage/s3.ts`) stamps a bucket whose author passed `backupExemption`,
+ *   and only when the bucket is versioned — an unversioned bucket is already
+ *   outside every plan, so it has nothing to exempt. The value names why the
+ *   bucket is not a source: `log-delivery` (an AWS service writes to it
+ *   continuously under its own lifecycle — VPC flow logs, CloudTrail, Config
+ *   delivery).
+ * - Consumer (webapp posture): the `MISSING_DR_TIER_TAG` rule reads key and
+ *   value to tell a versioned bucket that is deliberately not enrolled from
+ *   one that lost its tier by omission. Without it the rule raises a
+ *   permanent finding whose own auto-remediation cannot clear it, because no
+ *   construct will ever stamp that bucket.
+ *
+ * Key and values are deployed infrastructure state, read back by the same
+ * literals: a rename would return every exempt bucket to `open` until the next
+ * deploy. The pin test guards against casual renames.
+ */
+export declare const S3_BACKUP_EXEMPT_TAG_KEY = "fjall:s3:backup-exempt";
+/** The exemptions the tag may carry — each names a bucket that receives a service's log stream rather than holding recoverable state. */
+export declare const S3_BACKUP_EXEMPTIONS: readonly ["log-delivery"];
+export type S3BackupExemption = (typeof S3_BACKUP_EXEMPTIONS)[number];

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const e="fjall:sdk-pre-empty",t="fjall:kms:retention",r="fjall:kms:alias",o="fjall:resource:type",p={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},_="fjall:s3:versioning-exempt",c=["build-output","isr-cache","cold-tier","access-logs"];export{p as FJALL_RESOURCE_TYPES,o as FJALL_RESOURCE_TYPE_TAG_KEY,r as KMS_ALIAS_TAG_KEY,t as KMS_RETENTION_TAG_KEY,c as S3_VERSIONING_EXEMPTIONS,_ as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};
+const e="fjall:sdk-pre-empty",t="fjall:kms:retention",_="fjall:kms:alias",o="fjall:resource:type",r={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},p="fjall:s3:versioning-exempt",E=["build-output","isr-cache","cold-tier","access-logs"],c="fjall:s3:backup-exempt",s=["log-delivery"];export{r as FJALL_RESOURCE_TYPES,o as FJALL_RESOURCE_TYPE_TAG_KEY,_ as KMS_ALIAS_TAG_KEY,t as KMS_RETENTION_TAG_KEY,s as S3_BACKUP_EXEMPTIONS,c as S3_BACKUP_EXEMPT_TAG_KEY,E as S3_VERSIONING_EXEMPTIONS,p as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};

package/dist/backupTiers.d.ts

@@ -102,9 +102,13 @@ export declare const DEFAULT_BACKUP_TIER = "standard";
  */
 export declare function tierDefault<K extends keyof BackupTierDefaults>(tier: BackupTier | undefined, knob: K): BackupTierDefaults[K];
 /**
- * The tag key AWS Backup plan selection rules match on. The constructs stamp
- * it (`App.applyBackupTier()` app-wide, `StandardTagsAspect` per resource,
- * `BackupPlan` as the selection key). The webapp's posture rules
+ * The tag key AWS Backup plan selection rules match on. `BackupPlan` builds
+ * its selection from this key alone — the selection carries no resource-type
+ * filter, so the tag IS the selection scope — and the constructs that own a
+ * resource AWS Backup can protect stamp it at construction (`tagBackupTier`,
+ * called by the RDS instance, the Aurora cluster, the DynamoDB table, the
+ * ClickHouse data volume and a versioned bucket). It is not applied across
+ * the app, and no aspect applies it. The webapp's posture rules
  * (`assetParser`, `missing-dr-tier-tag`) read it back from discovered
  * resources and re-spell it until they import this — TODO 2026-09-14,
  * owner: paul — tracked in the 2026-09-05 remediation-raises build

package/dist/childEnvPolicy.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Environment policy for child processes that may execute UNTRUSTED code.
+ *
+ * `filterDangerousEnvVars` is a deny-list of exec-hijack names (NODE_OPTIONS,
+ * LD_PRELOAD, …). It strips no secret and no credential, so a caller that holds
+ * production secrets in `process.env` and spawns with it hands every one of them
+ * to the child. That is correct on an operator's laptop — the child is the
+ * operator's own code, running as the operator — and wrong in a multi-tenant
+ * worker, where the child is a customer's `infrastructure.ts`, their
+ * `node_modules/typescript`, or their `npm` install scripts.
+ *
+ * The two cases cannot share a default, so the policy is REQUIRED at every seam
+ * that builds a child environment: an absent policy would silently select the
+ * permissive one, and no gate in either repository would fire.
+ */
+/**
+ * How a child process inherits its parent's environment.
+ *
+ * - `inherit` — the parent's environment minus the exec-hijack deny-list. The
+ *   child is trusted to the same degree as the parent. `reason` records why,
+ *   so the choice is visible at the call site rather than defaulted into.
+ * - `isolate` — an ALLOW-LIST. Only names the child demonstrably needs survive;
+ *   everything else, secrets included, is dropped. `extraAllowed` admits names a
+ *   specific caller must add; it never re-admits a name on the never-list.
+ */
+export type ChildEnvPolicy = {
+    kind: "inherit";
+    reason: string;
+} | {
+    kind: "isolate";
+    extraAllowed?: readonly string[];
+};
+/**
+ * Names an isolated child may read. Anything absent is dropped, so this list is
+ * the contract: a child that needs a new name gets it added here (or via
+ * `extraAllowed`) rather than by widening the policy.
+ */
+export declare const CHILD_ENV_ALLOWED_NAMES: ReadonlySet<string>;
+/**
+ * Names an isolated child may NEVER read, even via `extraAllowed`.
+ *
+ * The ECS entries are the reason this list exists rather than being folded into
+ * "absent from the allow-list": they are how the container runtime hands a task
+ * its OWN role credentials. A customer child that reads
+ * `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI` fetches the deploy worker's
+ * production identity from 169.254.170.2 — a strictly larger prize than any
+ * single secret in the environment, and one no amount of secret-scrubbing
+ * removes. The web-identity pair is the same hazard on the IRSA and GitHub-OIDC
+ * lanes.
+ */
+export declare const CHILD_ENV_NEVER_NAMES: ReadonlySet<string>;
+/**
+ * For a `CdkArgumentBuilder` constructed purely to build argv — it never calls
+ * `buildCdkEnv`, so the policy is never consulted. Named rather than inlined so
+ * the reader can see the constructor argument is deliberate, and `isolate` so a
+ * future call to `buildCdkEnv` on such a builder fails safe rather than open.
+ */
+export declare const ARGV_ONLY_ENV_POLICY: ChildEnvPolicy;
+/**
+ * Build the environment for a child process under an explicit policy.
+ *
+ * `overrides` are applied after the policy and are NOT filtered — they are the
+ * caller's own deliberate writes (the credentials it just minted, the stage it
+ * resolved), not inherited ambient state. Under `isolate` the never-list is
+ * re-applied afterwards, so an override cannot reintroduce the task-role seam.
+ *
+ * The never-list does NOT apply under `inherit`: it carries `AWS_PROFILE` and
+ * the web-identity pair, which are exactly how an operator's laptop finds its
+ * identity. Removing them there would break every profile-based deploy to fix
+ * nothing — under `inherit` the child is already as trusted as the parent.
+ */
+export declare function buildChildEnv(policy: ChildEnvPolicy, source: NodeJS.ProcessEnv, overrides?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/childEnvPolicy.js

@@ -0,0 +1 @@
+var I=Object.defineProperty;var S=(_,A)=>I(_,"name",{value:A,configurable:!0});import{filterDangerousEnvVars as R}from"./securityHelpers.js";const C=new Set(["PATH","TMPDIR","TEMP","TMP","LANG","LANGUAGE","LC_ALL","LC_CTYPE","TZ","TERM","COLUMNS","CI","FORCE_COLOR","NO_COLOR","NODE_NO_WARNINGS","NODE_ENV","SSL_CERT_FILE","SSL_CERT_DIR","HTTP_PROXY","HTTPS_PROXY","NO_PROXY","http_proxy","https_proxy","no_proxy","ENVIRONMENT","AWS_ACCESS_KEY_ID","AWS_SECRET_ACCESS_KEY","AWS_SESSION_TOKEN","AWS_REGION","AWS_DEFAULT_REGION","AWS_STS_REGIONAL_ENDPOINTS","AWS_USE_FIPS_ENDPOINT","AWS_MAX_ATTEMPTS","AWS_RETRY_MODE","CDK_DEFAULT_ACCOUNT","CDK_DEFAULT_REGION","CDK_DISABLE_VERSION_CHECK","CDK_OUTDIR"]),T=new Set(["AWS_CONTAINER_CREDENTIALS_RELATIVE_URI","AWS_CONTAINER_CREDENTIALS_FULL_URI","AWS_CONTAINER_AUTHORIZATION_TOKEN","AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE","ECS_CONTAINER_METADATA_URI","ECS_CONTAINER_METADATA_URI_V4","AWS_WEB_IDENTITY_TOKEN_FILE","AWS_ROLE_ARN","AWS_ROLE_SESSION_NAME","AWS_PROFILE","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE"]),D={kind:"isolate"};function n(_,A,O){const N={..._.kind==="inherit"?R(A):Object.fromEntries(Object.entries(A).filter(([E])=>(C.has(E)||_.extraAllowed?.includes(E)===!0)&&!T.has(E))),...O};if(_.kind==="isolate")for(const E of T)delete N[E];return N}S(n,"buildChildEnv");export{D as ARGV_ONLY_ENV_POLICY,C as CHILD_ENV_ALLOWED_NAMES,T as CHILD_ENV_NEVER_NAMES,n as buildChildEnv};

package/dist/index.d.ts

@@ -5,6 +5,8 @@ export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
+export { APPLICATION_STACKS, type ApplicationStack, getApplicationStackName, isApplicationStack } from "./naming/applicationStackNames.js";
+export { stackScopedExportName, DEPLOYABLE_SERVICE_EXPORT_MARKER, DEPLOYABLE_CLUSTER_EXPORT_MARKER, CLUSTER_ARN_EXPORT_MARKER, VPC_CIDR_EXPORT_MARKER, deployableServiceExportName, legacyDeployableServiceExportName, isDeployableServiceExportName, deployableClusterExportName, clusterArnExportName, defaultVpcConstructId, vpcCidrExportName, legacyVpcCidrExportName, isVpcCidrExportName } from "./naming/stackExportNames.js";
 export { ec2ServiceName, mintedEc2KeyPairName } from "./naming/ec2Naming.js";
 export { CAPACITY_SLOT_PATTERN, CAPACITY_SLOT_MAX_LENGTH, DEFAULT_CAPACITY_SLOT, CAPACITY_ANCHOR_PATTERN, CAPACITY_ANCHOR_MAX_LENGTH, CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityPinSchema, type CapacityIdentityPin, CapacityIdentityWireSchema, type CapacityIdentityWire, CapacityIdentityConfigSchema, type CapacityIdentityConfig, projectCapacityIdentityToTarget } from "./capacityIdentity.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
@@ -13,6 +15,8 @@ export { normaliseError, getErrorMessage, hasErrorCode, getErrorCode, getErrorSt
 export { FJALL_CONFIG_DIR_ENV, FJALL_CREDENTIALS_FILENAME, FJALL_HOME_DIRNAME, FJALL_LOG_DIR_ENV, fjallCredentialsPath, fjallHomeDir, fjallLogDir, fjallStatePath } from "./fjallHome.js";
 export { singleton } from "./async/singleton.js";
 export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSensitiveOutput, parseShellArgs, REDACTED_KEY_SENTINEL, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
+export { ARGV_ONLY_ENV_POLICY, buildChildEnv, CHILD_ENV_ALLOWED_NAMES, CHILD_ENV_NEVER_NAMES } from "./childEnvPolicy.js";
+export type { ChildEnvPolicy } from "./childEnvPolicy.js";
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, type AccountStageEffect, accountStageEffect, ACCOUNT_STAGE_EFFECTS, formatAccountStageList, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as O,BackupVaultLockSchema as C,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as s}from"./infra/imageTags.js";import{toPascalCase as D,toKebab as c,toValidDatabaseName as M,toScreamingSnake as U,capitalise as f,getSafeZoneName as F,accountConstructKey as u,hasAsciiStableConstructKey as l}from"./naming/caseConversion.js";import{albDnsExportName as G,albHostedZoneIdExportName as d,cdnDomainExportName as g,bucketWebsiteEndpointExportName as V,bucketWebsiteHostedZoneIdExportName as Y}from"./naming/targetExportNames.js";import{ec2ServiceName as h,mintedEc2KeyPairName as K}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as B,CAPACITY_SLOT_MAX_LENGTH as v,DEFAULT_CAPACITY_SLOT as X,CAPACITY_ANCHOR_PATTERN as b,CAPACITY_ANCHOR_MAX_LENGTH as k,CAPACITY_IDENTITY_CONTEXT_KEY as W,CapacityIdentityPinSchema as J,CapacityIdentityWireSchema as j,CapacityIdentityConfigSchema as w,projectCapacityIdentityToTarget as Z}from"./capacityIdentity.js";import{findAccountNameCollision as z}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as $,suffixedAccountName as EE,REGION_SHORT_CODES as eE,findTrailingRegionShortCode as _E,regionSuffixRejectionMessage as rE}from"./naming/connectedAccountName.js";import{normaliseError as SE,getErrorMessage as AE,hasErrorCode as tE,getErrorCode as oE,getErrorStack as aE,formatErrorString as NE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as IE,FJALL_CREDENTIALS_FILENAME as OE,FJALL_HOME_DIRNAME as CE,FJALL_LOG_DIR_ENV as iE,fjallCredentialsPath as mE,fjallHomeDir as PE,fjallLogDir as nE,fjallStatePath as LE}from"./fjallHome.js";import{singleton as pE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as cE,filterDangerousEnvVars as ME,MASKED_VALUE_MARKER as UE,maskSensitiveOutput as fE,parseShellArgs as FE,REDACTED_KEY_SENTINEL as uE,SCOPED_TOKEN_REGEX as lE}from"./securityHelpers.js";import{sleep as GE}from"./async/sleep.js";import{mapSettledWithConcurrency as gE}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as YE,STRUCTURAL_ENVIRONMENTS as HE,ACCOUNT_STAGES as hE,ACCOUNT_STAGE_LABELS as KE,isAccountStage as yE,ACCOUNT_TIERS as BE,AccountTierSchema as vE,isAccountTier as XE,GOVERNANCE_ACCOUNT_TIERS as bE,isGovernanceTier as kE,environmentToTier as WE,accountStageEffect as JE,ACCOUNT_STAGE_EFFECTS as jE,formatAccountStageList as wE,stageFromWireEnvironment as ZE,accountTier as qE,resolveSynthEnvironment as zE,getEnvironmentLabel as QE,ACCOUNT_ROLES as $E}from"./environments.js";import{BACKUP_TIERS as ee,BACKUP_TIER_DEFAULTS as _e,BACKUP_TIER_TAG_KEY as re,BACKUP_TIER_TAG_MAP as Te,BackupTierSchema as Se,isBackupTier as Ae,tierDefault as te}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ae,isCodemodStatementType as Ne}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as Ie,categoriseResource as Oe,getExpectedDuration as Ce,getFriendlyResourceType as ie}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Pe}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Le,AWS_REGIONS_METADATA as se,DEFAULT_REGION as pe,getRegionInfo as De,MAX_SECONDARY_REGIONS as ce,OPT_IN_REGION_CODES as Me,optInRegionWarning as Ue,regions as fe,RETIRED_REGION_ABBREVIATIONS as Fe,suggestRegionForTimezone as ue}from"./infra/regions.js";import{SCOPE_VALUES as xe,MACHINE_ONLY_SCOPES as Ge,USER_GRANTABLE_SCOPES as de,GOVERNANCE_SCOPE_REQUIRED_CODE as ge,SESSION_ONLY_API_ROUTES as Ve}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as He,SECRET_NAME_ERROR as he,SSM_COMPONENT_PATTERN as Ke,SSM_COMPONENT_ERROR as ye,SSM_STANDARD_MAX_VALUE_BYTES as Be,SecretNamespaceSchema as ve,buildNamespaceParts as Xe,buildParameterPath as be,parseParameterPath as ke,isManageablePath as We,parseDotEnv as Je,escapeDotEnvValue as je}from"./secrets.js";import{ConnectionWireSchema as Ze,ConnectionsListResponseSchema as qe,CONNECTION_PHASES as ze,CONNECTION_TERMINAL_FAILURE_PHASES as Qe,CONNECTION_FAILURE_REASONS as $e,EXTERNAL_ID_PATTERN as E_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as __,isComplianceIssueStatus as r_,COMPLIANCE_ISSUE_SEVERITIES as T_}from"./complianceIssue.js";import{CI_PROVIDERS as A_,CI_SETUP_FIELDS as t_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as a_,CUSTOM_APP_TYPE as N_,APP_TYPES as R_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as O_,INSIGHT_CATEGORIES as C_,INSIGHT_SEVERITIES as i_,INSIGHT_SORT_VALUES as m_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as n_,INSTALL_SOURCES as L_,SETUP_COMMANDS as s_,upgradeCommand as p_,SETUP_MODES as D_,SETUP_STEP_IDS as c_,SETUP_STEPS as M_,AGENT_SETUP_PROMPTS as U_,AGENT_INSTALL_COMMAND as f_,SKILL_INSTALL_SEGMENTS as F_,SKILL_INSTALL_FILENAME as u_,SKILL_INSTALL_PATH as l_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as G_,deriveTargets as d_,deriveAllTargets as g_,environmentOrTier as V_,explainRetiredTargetName as Y_,findTarget as H_,generateTargetName as h_}from"./targets.js";import{buildAppConfigPath as y_}from"./repo/appPath.js";import{findInfrastructurePaths as v_,findBoundaryPath as X_,isInfrastructureFile as b_}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as W_}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as j_,RESERVED_APP_NAME_MESSAGE as w_,isReservedAppName as Z_,RESERVED_APP_NAME_SUFFIX as q_,RESERVED_APP_NAME_SUFFIX_MESSAGE as z_,hasReservedAppNameSuffix as Q_}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Er,CONTENT_HASH_TAG_PATTERN as er}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as rr,DeployModeSchema as Tr,IMAGE_TAG_PATTERN as Sr,ImageTagSchema as Ar,ServiceArtefactSchema as tr,ServiceArtefactsSchema as or,ARTEFACT_OUTPUT_FIELDS as ar,artefactOutputKey as Nr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Ir,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as Or,MIGRATION_SNAPSHOT_KIND_TAG_KEY as Cr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as ir,EXPECTED_SCHEMA_VERSION_ENV as mr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as Pr,EXPECTED_CH_SCHEMA_VERSION_ENV as nr,SCHEMA_ADMIN_USER_ENV as Lr,SCHEMA_ADMIN_PASSWORD_ENV as sr,PRISMA_MIGRATION_DIR_RE as pr,CLICKHOUSE_MIGRATION_SKIP_RE as Dr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as Mr,SCHEMA_GATE_EXIT_HINTS as Ur,schemaGateExitKind as fr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as ur,FJALL_MAINTENANCE_USER as lr,FJALL_CLICKHOUSE_USERS as xr}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as dr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Vr,PATTERN_TYPES as Yr,isPatternType as Hr,PATTERN_REGISTRY as hr,patternConstructId as Kr,DEPLOYABLE_PATTERN_TYPES as yr,PATTERN_TIER_VALUES as Br,OPENNEXT_PATTERN_TYPES as vr,isOpenNextPatternType as Xr,OPENNEXT_BUCKET_KEYS as br,isOpenNextBucketKey as kr,patternBucketConstructId as Wr,CLOUDFRONT_PRICE_CLASS_VALUES as Jr,STATIC_SITE_CONFIG_KEYS as jr,STATIC_SITE_DEPLOY_INJECTED_KEYS as wr,STATIC_SITE_CDN_CONFIG_KEYS as Zr,STATIC_SITE_ROUTING_VALUES as qr,STATIC_SITE_ROUTING_INFO as zr,PATTERN_CREATE_INPUT_VALUES as Qr,PATTERN_CREATE_INPUT_FLAGS as $r}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as eT,FRAMEWORKS as _T,isFramework as rT,FRAMEWORK_PATTERN_RECOMMENDATIONS as TT,recommendPatternForFramework as ST,CREATABLE_FRAMEWORKS as AT,requiredInputsForFramework as tT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as aT,defaultFormsFromAddress as NT,defaultFormsCorsOrigin as RT,isAddressAtDomain as IT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as CT,DEV_SUBSTRATE_PARAMS_FILENAME as iT,DevSubstrateSynthPropsSchema as mT,DevSubstrateParamsSchema as PT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as LT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as pT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as cT,DeploymentFailurePhaseSchema as MT,DEPLOYMENT_FAULT_ATTRIBUTIONS as UT,DeploymentFaultAttributionSchema as fT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as FT,DeploymentFailureProviderSourceSchema as uT,DEPLOYMENT_FAILURE_CODE_PATTERN as lT,DEPLOYMENT_FAILURE_SCHEMA_VERSION as xT,DEPLOYMENT_FAILURE_LIMITS as GT,DeploymentFailureAnalysisSchema as dT,DeploymentFailureProviderSchema as gT,DeploymentFailureResourceSchema as VT,DeploymentFailureSchema as YT,parseDeploymentFailure as HT,DEPLOYMENT_FAILURE_DOCS_BASE_URL as hT,deploymentFailureDocsUrl as KT,DEPLOYMENT_FAULT_COPY as yT,DEPLOYMENT_PROVIDER_LABELS as BT,deriveErrorMessageFromFailure as vT,toDeploymentFailureAnalysis as XT}from"./failure/deploymentFailure.js";import{extractErrorWindow as kT,ERROR_WINDOW_CONTEXT_LINES as WT}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as jT,FJALL_PROJECT_GITIGNORE as wT,FJALL_STATE_GITIGNORE_ENTRIES as ZT,FJALL_MANAGED_STATE_DIR_ENTRIES as qT,LOCAL_CONFIG_GITIGNORE_ENTRY as zT}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as $T}from"./scaffold/ensureGitignore.js";export{$E as ACCOUNT_ROLES,hE as ACCOUNT_STAGES,YE as ACCOUNT_STAGES_WITH_ROOT,jE as ACCOUNT_STAGE_EFFECTS,KE as ACCOUNT_STAGE_LABELS,BE as ACCOUNT_TIERS,f_ as AGENT_INSTALL_COMMAND,U_ as AGENT_SETUP_PROMPTS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,R_ as APP_TYPES,ar as ARTEFACT_OUTPUT_FIELDS,se as AWS_REGIONS_METADATA,vE as AccountTierSchema,ee as BACKUP_TIERS,_e as BACKUP_TIER_DEFAULTS,re as BACKUP_TIER_TAG_KEY,Te as BACKUP_TIER_TAG_MAP,O as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,pT as BLESSED_CDK_TOOLCHAIN,Se as BackupTierSchema,C as BackupVaultLockSchema,i as BackupVaultVerdictSchema,k as CAPACITY_ANCHOR_MAX_LENGTH,b as CAPACITY_ANCHOR_PATTERN,W as CAPACITY_IDENTITY_CONTEXT_KEY,v as CAPACITY_SLOT_MAX_LENGTH,B as CAPACITY_SLOT_PATTERN,A_ as CI_PROVIDERS,t_ as CI_SETUP_FIELDS,Dr as CLICKHOUSE_MIGRATION_SKIP_RE,Jr as CLOUDFRONT_PRICE_CLASS_VALUES,ae as CODEMOD_STATEMENT_TYPES,T_ as COMPLIANCE_ISSUE_SEVERITIES,__ as COMPLIANCE_ISSUE_STATUSES,$e as CONNECTION_FAILURE_REASONS,ze as CONNECTION_PHASES,Qe as CONNECTION_TERMINAL_FAILURE_PHASES,er as CONTENT_HASH_TAG_PATTERN,AT as CREATABLE_FRAMEWORKS,N_ as CUSTOM_APP_TYPE,w as CapacityIdentityConfigSchema,J as CapacityIdentityPinSchema,j as CapacityIdentityWireSchema,Ze as ConnectionWireSchema,qe as ConnectionsListResponseSchema,cE as DANGEROUS_ENV_VARS,X as DEFAULT_CAPACITY_SLOT,aT as DEFAULT_FORMS_FROM_LOCAL_PART,pe as DEFAULT_REGION,yr as DEPLOYABLE_PATTERN_TYPES,lT as DEPLOYMENT_FAILURE_CODE_PATTERN,hT as DEPLOYMENT_FAILURE_DOCS_BASE_URL,GT as DEPLOYMENT_FAILURE_LIMITS,cT as DEPLOYMENT_FAILURE_PHASES,FT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,xT as DEPLOYMENT_FAILURE_SCHEMA_VERSION,UT as DEPLOYMENT_FAULT_ATTRIBUTIONS,yT as DEPLOYMENT_FAULT_COPY,BT as DEPLOYMENT_PROVIDER_LABELS,rr as DEPLOY_MODES,LT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,iT as DEV_SUBSTRATE_PARAMS_FILENAME,CT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Tr as DeployModeSchema,dT as DeploymentFailureAnalysisSchema,MT as DeploymentFailurePhaseSchema,gT as DeploymentFailureProviderSchema,uT as DeploymentFailureProviderSourceSchema,VT as DeploymentFailureResourceSchema,YT as DeploymentFailureSchema,fT as DeploymentFaultAttributionSchema,PT as DevSubstrateParamsSchema,mT as DevSubstrateSynthPropsSchema,WT as ERROR_WINDOW_CONTEXT_LINES,nr as EXPECTED_CH_SCHEMA_VERSION_ENV,mr as EXPECTED_SCHEMA_VERSION_ENV,Pr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E_ as EXTERNAL_ID_PATTERN,xr as FJALL_CLICKHOUSE_USERS,jT as FJALL_COMPONENT_GITIGNORE,IE as FJALL_CONFIG_DIR_ENV,OE as FJALL_CREDENTIALS_FILENAME,CE as FJALL_HOME_DIRNAME,iE as FJALL_LOG_DIR_ENV,lr as FJALL_MAINTENANCE_USER,qT as FJALL_MANAGED_STATE_DIR_ENTRIES,wT as FJALL_PROJECT_GITIGNORE,ur as FJALL_SCHEMA_GATE_USER,ZT as FJALL_STATE_GITIGNORE_ENTRIES,_T as FRAMEWORKS,TT as FRAMEWORK_PATTERN_RECOMMENDATIONS,eT as FRAMEWORK_VALUES,bE as GOVERNANCE_ACCOUNT_TIERS,ge as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,Sr as IMAGE_TAG_PATTERN,a_ as INFRASTRUCTURE_TIER_NAMES,C_ as INSIGHT_CATEGORIES,i_ as INSIGHT_SEVERITIES,m_ as INSIGHT_SORT_VALUES,O_ as INSIGHT_TAB_VALUES,L_ as INSTALL_SOURCES,Ar as ImageTagSchema,zT as LOCAL_CONFIG_GITIGNORE_ENTRY,Ge as MACHINE_ONLY_SCOPES,UE as MASKED_VALUE_MARKER,ce as MAX_SECONDARY_REGIONS,ir as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,Cr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Ir as MIGRATION_SNAPSHOT_NAME_PREFIX,Or as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,br as OPENNEXT_BUCKET_KEYS,vr as OPENNEXT_PATTERN_TYPES,Me as OPT_IN_REGION_CODES,$r as PATTERN_CREATE_INPUT_FLAGS,Qr as PATTERN_CREATE_INPUT_VALUES,hr as PATTERN_REGISTRY,Br as PATTERN_TIER_VALUES,Yr as PATTERN_TYPES,Vr as PATTERN_TYPE_VALUES,dr as PHYSICAL_NAME_FALLBACK_PROPERTIES,pr as PRISMA_MIGRATION_DIR_RE,n_ as PUBLIC_PACKAGE_NAME,uE as REDACTED_KEY_SENTINEL,eE as REGION_SHORT_CODES,j_ as RESERVED_APP_NAMES,w_ as RESERVED_APP_NAME_MESSAGE,q_ as RESERVED_APP_NAME_SUFFIX,z_ as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ie as RESOURCE_CATEGORIES,Fe as RETIRED_REGION_ABBREVIATIONS,sr as SCHEMA_ADMIN_PASSWORD_ENV,Lr as SCHEMA_ADMIN_USER_ENV,Mr as SCHEMA_GATE_EXIT,Ur as SCHEMA_GATE_EXIT_HINTS,lE as SCOPED_TOKEN_REGEX,xe as SCOPE_VALUES,he as SECRET_NAME_ERROR,He as SECRET_NAME_PATTERN,Ve as SESSION_ONLY_API_ROUTES,s_ as SETUP_COMMANDS,D_ as SETUP_MODES,M_ as SETUP_STEPS,c_ as SETUP_STEP_IDS,u_ as SKILL_INSTALL_FILENAME,l_ as SKILL_INSTALL_PATH,F_ as SKILL_INSTALL_SEGMENTS,ye as SSM_COMPONENT_ERROR,Ke as SSM_COMPONENT_PATTERN,Be as SSM_STANDARD_MAX_VALUE_BYTES,Zr as STATIC_SITE_CDN_CONFIG_KEYS,jr as STATIC_SITE_CONFIG_KEYS,wr as STATIC_SITE_DEPLOY_INJECTED_KEYS,zr as STATIC_SITE_ROUTING_INFO,qr as STATIC_SITE_ROUTING_VALUES,HE as STRUCTURAL_ENVIRONMENTS,ve as SecretNamespaceSchema,tr as ServiceArtefactSchema,or as ServiceArtefactsSchema,de as USER_GRANTABLE_SCOPES,Le as abbreviateRegion,u as accountConstructKey,JE as accountStageEffect,qE as accountTier,G as albDnsExportName,d as albHostedZoneIdExportName,Nr as artefactOutputKey,V as bucketWebsiteEndpointExportName,Y as bucketWebsiteHostedZoneIdExportName,y_ as buildAppConfigPath,Xe as buildNamespaceParts,be as buildParameterPath,f as capitalise,Oe as categoriseResource,g as cdnDomainExportName,$ as defaultConnectedAccountName,RT as defaultFormsCorsOrigin,NT as defaultFormsFromAddress,KT as deploymentFailureDocsUrl,g_ as deriveAllTargets,Er as deriveContentHashTag,vT as deriveErrorMessageFromFailure,G_ as deriveRegionsFromOrgConfig,d_ as deriveTargets,h as ec2ServiceName,$T as ensureGitignoreEntries,V_ as environmentOrTier,WE as environmentToTier,je as escapeDotEnvValue,Y_ as explainRetiredTargetName,kT as extractErrorWindow,ME as filterDangerousEnvVars,z as findAccountNameCollision,X_ as findBoundaryPath,v_ as findInfrastructurePaths,H_ as findTarget,_E as findTrailingRegionShortCode,mE as fjallCredentialsPath,PE as fjallHomeDir,nE as fjallLogDir,LE as fjallStatePath,wE as formatAccountStageList,NE as formatErrorString,h_ as generateTargetName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,QE as getEnvironmentLabel,oE as getErrorCode,AE as getErrorMessage,aE as getErrorStack,Ce as getExpectedDuration,ie as getFriendlyResourceType,De as getRegionInfo,F as getSafeZoneName,l as hasAsciiStableConstructKey,tE as hasErrorCode,Q_ as hasReservedAppNameSuffix,A as hostsExportPartName,s as imageTagParameterName,W_ as inferContainerFromCandidates,yE as isAccountStage,XE as isAccountTier,IT as isAddressAtDomain,Ae as isBackupTier,Ne as isCodemodStatementType,r_ as isComplianceIssueStatus,rT as isFramework,kE as isGovernanceTier,b_ as isInfrastructureFile,We as isManageablePath,a as isManagedDomainBinding,kr as isOpenNextBucketKey,Xr as isOpenNextPatternType,Hr as isPatternType,m as isReownedBackupVault,Z_ as isReservedAppName,gE as mapSettledWithConcurrency,fE as maskSensitiveOutput,K as mintedEc2KeyPairName,SE as normaliseError,Ue as optInRegionWarning,HT as parseDeploymentFailure,Je as parseDotEnv,Pe as parseGitRemoteUrl,ke as parseParameterPath,FE as parseShellArgs,Wr as patternBucketConstructId,Kr as patternConstructId,Z as projectCapacityIdentityToTarget,ST as recommendPatternForFramework,rE as regionSuffixRejectionMessage,fe as regions,tT as requiredInputsForFramework,zE as resolveSynthEnvironment,fr as schemaGateExitKind,t as serialiseHostsChunks,pE as singleton,GE as sleep,ZE as stageFromWireEnvironment,EE as suffixedAccountName,ue as suggestRegionForTimezone,te as tierDefault,XT as toDeploymentFailureAnalysis,c as toKebab,D as toPascalCase,U as toScreamingSnake,M as toValidDatabaseName,p_ as upgradeCommand};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as C,BackupVaultLockSchema as O,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as p}from"./infra/imageTags.js";import{toPascalCase as c,toKebab as D,toValidDatabaseName as M,toScreamingSnake as U,capitalise as f,getSafeZoneName as l,accountConstructKey as F,hasAsciiStableConstructKey as u}from"./naming/caseConversion.js";import{albDnsExportName as d,albHostedZoneIdExportName as G,cdnDomainExportName as g,bucketWebsiteEndpointExportName as V,bucketWebsiteHostedZoneIdExportName as Y}from"./naming/targetExportNames.js";import{APPLICATION_STACKS as K,getApplicationStackName as h,isApplicationStack as y}from"./naming/applicationStackNames.js";import{stackScopedExportName as v,DEPLOYABLE_SERVICE_EXPORT_MARKER as X,DEPLOYABLE_CLUSTER_EXPORT_MARKER as b,CLUSTER_ARN_EXPORT_MARKER as k,VPC_CIDR_EXPORT_MARKER as W,deployableServiceExportName as J,legacyDeployableServiceExportName as j,isDeployableServiceExportName as w,deployableClusterExportName as Z,clusterArnExportName as q,defaultVpcConstructId as z,vpcCidrExportName as Q,legacyVpcCidrExportName as $,isVpcCidrExportName as EE}from"./naming/stackExportNames.js";import{ec2ServiceName as _E,mintedEc2KeyPairName as rE}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as SE,CAPACITY_SLOT_MAX_LENGTH as AE,DEFAULT_CAPACITY_SLOT as tE,CAPACITY_ANCHOR_PATTERN as oE,CAPACITY_ANCHOR_MAX_LENGTH as aE,CAPACITY_IDENTITY_CONTEXT_KEY as NE,CapacityIdentityPinSchema as RE,CapacityIdentityWireSchema as IE,CapacityIdentityConfigSchema as CE,projectCapacityIdentityToTarget as OE}from"./capacityIdentity.js";import{findAccountNameCollision as mE}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as nE,suffixedAccountName as LE,REGION_SHORT_CODES as pE,findTrailingRegionShortCode as sE,regionSuffixRejectionMessage as cE}from"./naming/connectedAccountName.js";import{normaliseError as ME,getErrorMessage as UE,hasErrorCode as fE,getErrorCode as lE,getErrorStack as FE,formatErrorString as uE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as dE,FJALL_CREDENTIALS_FILENAME as GE,FJALL_HOME_DIRNAME as gE,FJALL_LOG_DIR_ENV as VE,fjallCredentialsPath as YE,fjallHomeDir as HE,fjallLogDir as KE,fjallStatePath as hE}from"./fjallHome.js";import{singleton as BE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as XE,filterDangerousEnvVars as bE,MASKED_VALUE_MARKER as kE,maskSensitiveOutput as WE,parseShellArgs as JE,REDACTED_KEY_SENTINEL as jE,SCOPED_TOKEN_REGEX as wE}from"./securityHelpers.js";import{ARGV_ONLY_ENV_POLICY as qE,buildChildEnv as zE,CHILD_ENV_ALLOWED_NAMES as QE,CHILD_ENV_NEVER_NAMES as $E}from"./childEnvPolicy.js";import{sleep as ee}from"./async/sleep.js";import{mapSettledWithConcurrency as re}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Se,STRUCTURAL_ENVIRONMENTS as Ae,ACCOUNT_STAGES as te,ACCOUNT_STAGE_LABELS as oe,isAccountStage as ae,ACCOUNT_TIERS as Ne,AccountTierSchema as Re,isAccountTier as Ie,GOVERNANCE_ACCOUNT_TIERS as Ce,isGovernanceTier as Oe,environmentToTier as ie,accountStageEffect as me,ACCOUNT_STAGE_EFFECTS as Pe,formatAccountStageList as ne,stageFromWireEnvironment as Le,accountTier as pe,resolveSynthEnvironment as se,getEnvironmentLabel as ce,ACCOUNT_ROLES as De}from"./environments.js";import{BACKUP_TIERS as Ue,BACKUP_TIER_DEFAULTS as fe,BACKUP_TIER_TAG_KEY as le,BACKUP_TIER_TAG_MAP as Fe,BackupTierSchema as ue,isBackupTier as xe,tierDefault as de}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ge,isCodemodStatementType as Ve}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as He,categoriseResource as Ke,getExpectedDuration as he,getFriendlyResourceType as ye}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ve}from"./repo/gitRemoteParser.js";import{abbreviateRegion as be,AWS_REGIONS_METADATA as ke,DEFAULT_REGION as We,getRegionInfo as Je,MAX_SECONDARY_REGIONS as je,OPT_IN_REGION_CODES as we,optInRegionWarning as Ze,regions as qe,RETIRED_REGION_ABBREVIATIONS as ze,suggestRegionForTimezone as Qe}from"./infra/regions.js";import{SCOPE_VALUES as E_,MACHINE_ONLY_SCOPES as e_,USER_GRANTABLE_SCOPES as __,GOVERNANCE_SCOPE_REQUIRED_CODE as r_,SESSION_ONLY_API_ROUTES as T_}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as A_,SECRET_NAME_ERROR as t_,SSM_COMPONENT_PATTERN as o_,SSM_COMPONENT_ERROR as a_,SSM_STANDARD_MAX_VALUE_BYTES as N_,SecretNamespaceSchema as R_,buildNamespaceParts as I_,buildParameterPath as C_,parseParameterPath as O_,isManageablePath as i_,parseDotEnv as m_,escapeDotEnvValue as P_}from"./secrets.js";import{ConnectionWireSchema as L_,ConnectionsListResponseSchema as p_,CONNECTION_PHASES as s_,CONNECTION_TERMINAL_FAILURE_PHASES as c_,CONNECTION_FAILURE_REASONS as D_,EXTERNAL_ID_PATTERN as M_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as f_,isComplianceIssueStatus as l_,COMPLIANCE_ISSUE_SEVERITIES as F_}from"./complianceIssue.js";import{CI_PROVIDERS as x_,CI_SETUP_FIELDS as d_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as g_,CUSTOM_APP_TYPE as V_,APP_TYPES as Y_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as K_,INSIGHT_CATEGORIES as h_,INSIGHT_SEVERITIES as y_,INSIGHT_SORT_VALUES as B_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as X_,INSTALL_SOURCES as b_,SETUP_COMMANDS as k_,upgradeCommand as W_,SETUP_MODES as J_,SETUP_STEP_IDS as j_,SETUP_STEPS as w_,AGENT_SETUP_PROMPTS as Z_,AGENT_INSTALL_COMMAND as q_,SKILL_INSTALL_SEGMENTS as z_,SKILL_INSTALL_FILENAME as Q_,SKILL_INSTALL_PATH as $_}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as er,deriveTargets as _r,deriveAllTargets as rr,environmentOrTier as Tr,explainRetiredTargetName as Sr,findTarget as Ar,generateTargetName as tr}from"./targets.js";import{buildAppConfigPath as ar}from"./repo/appPath.js";import{findInfrastructurePaths as Rr,findBoundaryPath as Ir,isInfrastructureFile as Cr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as ir}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Pr,RESERVED_APP_NAME_MESSAGE as nr,isReservedAppName as Lr,RESERVED_APP_NAME_SUFFIX as pr,RESERVED_APP_NAME_SUFFIX_MESSAGE as sr,hasReservedAppNameSuffix as cr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Mr,CONTENT_HASH_TAG_PATTERN as Ur}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as lr,DeployModeSchema as Fr,IMAGE_TAG_PATTERN as ur,ImageTagSchema as xr,ServiceArtefactSchema as dr,ServiceArtefactsSchema as Gr,ARTEFACT_OUTPUT_FIELDS as gr,artefactOutputKey as Vr}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Hr,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as Kr,MIGRATION_SNAPSHOT_KIND_TAG_KEY as hr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as yr,EXPECTED_SCHEMA_VERSION_ENV as Br,EXPECTED_SCHEMA_VERSION_TOOL_ENV as vr,EXPECTED_CH_SCHEMA_VERSION_ENV as Xr,SCHEMA_ADMIN_USER_ENV as br,SCHEMA_ADMIN_PASSWORD_ENV as kr,PRISMA_MIGRATION_DIR_RE as Wr,CLICKHOUSE_MIGRATION_SKIP_RE as Jr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as wr,SCHEMA_GATE_EXIT_HINTS as Zr,schemaGateExitKind as qr}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as Qr,FJALL_MAINTENANCE_USER as $r,FJALL_CLICKHOUSE_USERS as ET}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as _T}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as TT,PATTERN_TYPES as ST,isPatternType as AT,PATTERN_REGISTRY as tT,patternConstructId as oT,DEPLOYABLE_PATTERN_TYPES as aT,PATTERN_TIER_VALUES as NT,OPENNEXT_PATTERN_TYPES as RT,isOpenNextPatternType as IT,OPENNEXT_BUCKET_KEYS as CT,isOpenNextBucketKey as OT,patternBucketConstructId as iT,CLOUDFRONT_PRICE_CLASS_VALUES as mT,STATIC_SITE_CONFIG_KEYS as PT,STATIC_SITE_DEPLOY_INJECTED_KEYS as nT,STATIC_SITE_CDN_CONFIG_KEYS as LT,STATIC_SITE_ROUTING_VALUES as pT,STATIC_SITE_ROUTING_INFO as sT,PATTERN_CREATE_INPUT_VALUES as cT,PATTERN_CREATE_INPUT_FLAGS as DT}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as UT,FRAMEWORKS as fT,isFramework as lT,FRAMEWORK_PATTERN_RECOMMENDATIONS as FT,recommendPatternForFramework as uT,CREATABLE_FRAMEWORKS as xT,requiredInputsForFramework as dT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as gT,defaultFormsFromAddress as VT,defaultFormsCorsOrigin as YT,isAddressAtDomain as HT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as hT,DEV_SUBSTRATE_PARAMS_FILENAME as yT,DevSubstrateSynthPropsSchema as BT,DevSubstrateParamsSchema as vT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as bT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as WT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as jT,DeploymentFailurePhaseSchema as wT,DEPLOYMENT_FAULT_ATTRIBUTIONS as ZT,DeploymentFaultAttributionSchema as qT,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as zT,DeploymentFailureProviderSourceSchema as QT,DEPLOYMENT_FAILURE_CODE_PATTERN as $T,DEPLOYMENT_FAILURE_SCHEMA_VERSION as ES,DEPLOYMENT_FAILURE_LIMITS as eS,DeploymentFailureAnalysisSchema as _S,DeploymentFailureProviderSchema as rS,DeploymentFailureResourceSchema as TS,DeploymentFailureSchema as SS,parseDeploymentFailure as AS,DEPLOYMENT_FAILURE_DOCS_BASE_URL as tS,deploymentFailureDocsUrl as oS,DEPLOYMENT_FAULT_COPY as aS,DEPLOYMENT_PROVIDER_LABELS as NS,deriveErrorMessageFromFailure as RS,toDeploymentFailureAnalysis as IS}from"./failure/deploymentFailure.js";import{extractErrorWindow as OS,ERROR_WINDOW_CONTEXT_LINES as iS}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as PS,FJALL_PROJECT_GITIGNORE as nS,FJALL_STATE_GITIGNORE_ENTRIES as LS,FJALL_MANAGED_STATE_DIR_ENTRIES as pS,LOCAL_CONFIG_GITIGNORE_ENTRY as sS}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as DS}from"./scaffold/ensureGitignore.js";export{De as ACCOUNT_ROLES,te as ACCOUNT_STAGES,Se as ACCOUNT_STAGES_WITH_ROOT,Pe as ACCOUNT_STAGE_EFFECTS,oe as ACCOUNT_STAGE_LABELS,Ne as ACCOUNT_TIERS,q_ as AGENT_INSTALL_COMMAND,Z_ as AGENT_SETUP_PROMPTS,K as APPLICATION_STACKS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,Y_ as APP_TYPES,qE as ARGV_ONLY_ENV_POLICY,gr as ARTEFACT_OUTPUT_FIELDS,ke as AWS_REGIONS_METADATA,Re as AccountTierSchema,Ue as BACKUP_TIERS,fe as BACKUP_TIER_DEFAULTS,le as BACKUP_TIER_TAG_KEY,Fe as BACKUP_TIER_TAG_MAP,C as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,WT as BLESSED_CDK_TOOLCHAIN,ue as BackupTierSchema,O as BackupVaultLockSchema,i as BackupVaultVerdictSchema,aE as CAPACITY_ANCHOR_MAX_LENGTH,oE as CAPACITY_ANCHOR_PATTERN,NE as CAPACITY_IDENTITY_CONTEXT_KEY,AE as CAPACITY_SLOT_MAX_LENGTH,SE as CAPACITY_SLOT_PATTERN,QE as CHILD_ENV_ALLOWED_NAMES,$E as CHILD_ENV_NEVER_NAMES,x_ as CI_PROVIDERS,d_ as CI_SETUP_FIELDS,Jr as CLICKHOUSE_MIGRATION_SKIP_RE,mT as CLOUDFRONT_PRICE_CLASS_VALUES,k as CLUSTER_ARN_EXPORT_MARKER,ge as CODEMOD_STATEMENT_TYPES,F_ as COMPLIANCE_ISSUE_SEVERITIES,f_ as COMPLIANCE_ISSUE_STATUSES,D_ as CONNECTION_FAILURE_REASONS,s_ as CONNECTION_PHASES,c_ as CONNECTION_TERMINAL_FAILURE_PHASES,Ur as CONTENT_HASH_TAG_PATTERN,xT as CREATABLE_FRAMEWORKS,V_ as CUSTOM_APP_TYPE,CE as CapacityIdentityConfigSchema,RE as CapacityIdentityPinSchema,IE as CapacityIdentityWireSchema,L_ as ConnectionWireSchema,p_ as ConnectionsListResponseSchema,XE as DANGEROUS_ENV_VARS,tE as DEFAULT_CAPACITY_SLOT,gT as DEFAULT_FORMS_FROM_LOCAL_PART,We as DEFAULT_REGION,b as DEPLOYABLE_CLUSTER_EXPORT_MARKER,aT as DEPLOYABLE_PATTERN_TYPES,X as DEPLOYABLE_SERVICE_EXPORT_MARKER,$T as DEPLOYMENT_FAILURE_CODE_PATTERN,tS as DEPLOYMENT_FAILURE_DOCS_BASE_URL,eS as DEPLOYMENT_FAILURE_LIMITS,jT as DEPLOYMENT_FAILURE_PHASES,zT as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,ES as DEPLOYMENT_FAILURE_SCHEMA_VERSION,ZT as DEPLOYMENT_FAULT_ATTRIBUTIONS,aS as DEPLOYMENT_FAULT_COPY,NS as DEPLOYMENT_PROVIDER_LABELS,lr as DEPLOY_MODES,bT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,yT as DEV_SUBSTRATE_PARAMS_FILENAME,hT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Fr as DeployModeSchema,_S as DeploymentFailureAnalysisSchema,wT as DeploymentFailurePhaseSchema,rS as DeploymentFailureProviderSchema,QT as DeploymentFailureProviderSourceSchema,TS as DeploymentFailureResourceSchema,SS as DeploymentFailureSchema,qT as DeploymentFaultAttributionSchema,vT as DevSubstrateParamsSchema,BT as DevSubstrateSynthPropsSchema,iS as ERROR_WINDOW_CONTEXT_LINES,Xr as EXPECTED_CH_SCHEMA_VERSION_ENV,Br as EXPECTED_SCHEMA_VERSION_ENV,vr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,M_ as EXTERNAL_ID_PATTERN,ET as FJALL_CLICKHOUSE_USERS,PS as FJALL_COMPONENT_GITIGNORE,dE as FJALL_CONFIG_DIR_ENV,GE as FJALL_CREDENTIALS_FILENAME,gE as FJALL_HOME_DIRNAME,VE as FJALL_LOG_DIR_ENV,$r as FJALL_MAINTENANCE_USER,pS as FJALL_MANAGED_STATE_DIR_ENTRIES,nS as FJALL_PROJECT_GITIGNORE,Qr as FJALL_SCHEMA_GATE_USER,LS as FJALL_STATE_GITIGNORE_ENTRIES,fT as FRAMEWORKS,FT as FRAMEWORK_PATTERN_RECOMMENDATIONS,UT as FRAMEWORK_VALUES,Ce as GOVERNANCE_ACCOUNT_TIERS,r_ as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,ur as IMAGE_TAG_PATTERN,g_ as INFRASTRUCTURE_TIER_NAMES,h_ as INSIGHT_CATEGORIES,y_ as INSIGHT_SEVERITIES,B_ as INSIGHT_SORT_VALUES,K_ as INSIGHT_TAB_VALUES,b_ as INSTALL_SOURCES,xr as ImageTagSchema,sS as LOCAL_CONFIG_GITIGNORE_ENTRY,e_ as MACHINE_ONLY_SCOPES,kE as MASKED_VALUE_MARKER,je as MAX_SECONDARY_REGIONS,yr as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,hr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Hr as MIGRATION_SNAPSHOT_NAME_PREFIX,Kr as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,CT as OPENNEXT_BUCKET_KEYS,RT as OPENNEXT_PATTERN_TYPES,we as OPT_IN_REGION_CODES,DT as PATTERN_CREATE_INPUT_FLAGS,cT as PATTERN_CREATE_INPUT_VALUES,tT as PATTERN_REGISTRY,NT as PATTERN_TIER_VALUES,ST as PATTERN_TYPES,TT as PATTERN_TYPE_VALUES,_T as PHYSICAL_NAME_FALLBACK_PROPERTIES,Wr as PRISMA_MIGRATION_DIR_RE,X_ as PUBLIC_PACKAGE_NAME,jE as REDACTED_KEY_SENTINEL,pE as REGION_SHORT_CODES,Pr as RESERVED_APP_NAMES,nr as RESERVED_APP_NAME_MESSAGE,pr as RESERVED_APP_NAME_SUFFIX,sr as RESERVED_APP_NAME_SUFFIX_MESSAGE,He as RESOURCE_CATEGORIES,ze as RETIRED_REGION_ABBREVIATIONS,kr as SCHEMA_ADMIN_PASSWORD_ENV,br as SCHEMA_ADMIN_USER_ENV,wr as SCHEMA_GATE_EXIT,Zr as SCHEMA_GATE_EXIT_HINTS,wE as SCOPED_TOKEN_REGEX,E_ as SCOPE_VALUES,t_ as SECRET_NAME_ERROR,A_ as SECRET_NAME_PATTERN,T_ as SESSION_ONLY_API_ROUTES,k_ as SETUP_COMMANDS,J_ as SETUP_MODES,w_ as SETUP_STEPS,j_ as SETUP_STEP_IDS,Q_ as SKILL_INSTALL_FILENAME,$_ as SKILL_INSTALL_PATH,z_ as SKILL_INSTALL_SEGMENTS,a_ as SSM_COMPONENT_ERROR,o_ as SSM_COMPONENT_PATTERN,N_ as SSM_STANDARD_MAX_VALUE_BYTES,LT as STATIC_SITE_CDN_CONFIG_KEYS,PT as STATIC_SITE_CONFIG_KEYS,nT as STATIC_SITE_DEPLOY_INJECTED_KEYS,sT as STATIC_SITE_ROUTING_INFO,pT as STATIC_SITE_ROUTING_VALUES,Ae as STRUCTURAL_ENVIRONMENTS,R_ as SecretNamespaceSchema,dr as ServiceArtefactSchema,Gr as ServiceArtefactsSchema,__ as USER_GRANTABLE_SCOPES,W as VPC_CIDR_EXPORT_MARKER,be as abbreviateRegion,F as accountConstructKey,me as accountStageEffect,pe as accountTier,d as albDnsExportName,G as albHostedZoneIdExportName,Vr as artefactOutputKey,V as bucketWebsiteEndpointExportName,Y as bucketWebsiteHostedZoneIdExportName,ar as buildAppConfigPath,zE as buildChildEnv,I_ as buildNamespaceParts,C_ as buildParameterPath,f as capitalise,Ke as categoriseResource,g as cdnDomainExportName,q as clusterArnExportName,nE as defaultConnectedAccountName,YT as defaultFormsCorsOrigin,VT as defaultFormsFromAddress,z as defaultVpcConstructId,Z as deployableClusterExportName,J as deployableServiceExportName,oS as deploymentFailureDocsUrl,rr as deriveAllTargets,Mr as deriveContentHashTag,RS as deriveErrorMessageFromFailure,er as deriveRegionsFromOrgConfig,_r as deriveTargets,_E as ec2ServiceName,DS as ensureGitignoreEntries,Tr as environmentOrTier,ie as environmentToTier,P_ as escapeDotEnvValue,Sr as explainRetiredTargetName,OS as extractErrorWindow,bE as filterDangerousEnvVars,mE as findAccountNameCollision,Ir as findBoundaryPath,Rr as findInfrastructurePaths,Ar as findTarget,sE as findTrailingRegionShortCode,YE as fjallCredentialsPath,HE as fjallHomeDir,KE as fjallLogDir,hE as fjallStatePath,ne as formatAccountStageList,uE as formatErrorString,tr as generateTargetName,h as getApplicationStackName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,ce as getEnvironmentLabel,lE as getErrorCode,UE as getErrorMessage,FE as getErrorStack,he as getExpectedDuration,ye as getFriendlyResourceType,Je as getRegionInfo,l as getSafeZoneName,u as hasAsciiStableConstructKey,fE as hasErrorCode,cr as hasReservedAppNameSuffix,A as hostsExportPartName,p as imageTagParameterName,ir as inferContainerFromCandidates,ae as isAccountStage,Ie as isAccountTier,HT as isAddressAtDomain,y as isApplicationStack,xe as isBackupTier,Ve as isCodemodStatementType,l_ as isComplianceIssueStatus,w as isDeployableServiceExportName,lT as isFramework,Oe as isGovernanceTier,Cr as isInfrastructureFile,i_ as isManageablePath,a as isManagedDomainBinding,OT as isOpenNextBucketKey,IT as isOpenNextPatternType,AT as isPatternType,m as isReownedBackupVault,Lr as isReservedAppName,EE as isVpcCidrExportName,j as legacyDeployableServiceExportName,$ as legacyVpcCidrExportName,re as mapSettledWithConcurrency,WE as maskSensitiveOutput,rE as mintedEc2KeyPairName,ME as normaliseError,Ze as optInRegionWarning,AS as parseDeploymentFailure,m_ as parseDotEnv,ve as parseGitRemoteUrl,O_ as parseParameterPath,JE as parseShellArgs,iT as patternBucketConstructId,oT as patternConstructId,OE as projectCapacityIdentityToTarget,uT as recommendPatternForFramework,cE as regionSuffixRejectionMessage,qe as regions,dT as requiredInputsForFramework,se as resolveSynthEnvironment,qr as schemaGateExitKind,t as serialiseHostsChunks,BE as singleton,ee as sleep,v as stackScopedExportName,Le as stageFromWireEnvironment,LE as suffixedAccountName,Qe as suggestRegionForTimezone,de as tierDefault,IS as toDeploymentFailureAnalysis,D as toKebab,c as toPascalCase,U as toScreamingSnake,M as toValidDatabaseName,W_ as upgradeCommand,Q as vpcCidrExportName};

package/dist/manifest/io.d.ts

@@ -75,6 +75,15 @@ export interface ManifestDockerService {
      * `dockerPlatformForArchitecture` in `@fjall/util/docker`.
      */
     readonly architecture?: LambdaArchitecture;
+    /**
+     * The ECS cluster the service is placed in — the construct id of the
+     * cluster, which is also its physical cluster name and the token the
+     * `DeployableService` export is built from. Present for every service the
+     * compute pattern records (constructs >= 0.87.0); absent for a manifest
+     * written by an older assembly, in which case the deploy engine cannot
+     * bind the entry to a live service by name and must say so.
+     */
+    readonly clusterName?: string;
 }
 /**
  * The engine-compatibility envelope, hand-walked from the manifest rather than

package/dist/manifest/io.js

@@ -1 +1 @@
-var M=Object.defineProperty;var s=(n,e)=>M(n,"name",{value:e,configurable:!0});import{readFile as k,writeFile as E,unlink as N,rename as S,mkdir as w}from"fs/promises";import{readFileSync as p}from"fs";import{dirname as F,join as m}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as x}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as A}from"../constructMap.js";import{FjallManifestSchema as v,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as j,normaliseDockerBuild as y,LAMBDA_ARCHITECTURE_VALUES as C}from"./schemas.js";function h(n){return m(n,l)}s(h,"getManifestFilePath");async function O(n){const e=h(n);if(!await x(e))return{status:"absent"};try{const a=await k(e,"utf-8"),t=JSON.parse(a),r=v.safeParse(t);if(!r.success){const i=f(r.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:r.data}}catch(a){const t=f(d(a));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(O,"readManifestFileOutcome");async function I(n){const e=await O(n);return e.status==="ok"?e.manifest:null}s(I,"readManifestFile");async function U(n,e){const a=h(n),t=`${a}.${Date.now()}.tmp`;await w(F(a),{recursive:!0});try{await E(t,JSON.stringify(e,null,2),"utf-8"),await S(t,a)}catch(r){try{await N(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw r}}s(U,"writeManifestFile");function q(n){return{version:j,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(q,"createEmptyManifest");async function z(n){const e=await I(n);return e?.resourceMap?A(e.resourceMap):new Map}s(z,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function g(n,e){const a=m(n,l);let t;try{t=p(a,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:a});return}let r;try{r=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:a});return}return u(r)?r:void 0}s(g,"readManifestRecord");function T(n){const e=n.engineCompat;if(!u(e))return;const a=e.minimumEngineVersion;if(typeof a!="string"||a.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",r=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:a,...r!==void 0&&{maximumEngineMajor:r},...o!==void 0&&{minimumAwsCdkCli:o}}}s(T,"extractEngineCompat");function Q(n){const e=g(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const a=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),r=T(e);return{manifestVersion:a,engineCompatPresent:t,engineCompat:r}}s(Q,"readEngineCompatEnvelope");function W(n){const e=$(n);return e.status==="ok"?e.appName:void 0}s(W,"readManifestAppName");function $(n){const e=m(n,l);let a;try{a=p(e,"utf-8")}catch(r){const i=r!==null&&typeof r=="object"&&"code"in r?r.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(r))}),{status:"unreadable"})}let t;try{t=JSON.parse(a)}catch(r){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(r))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s($,"readManifestAppNameOutcome");function D(n){const e=g(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const a=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const r=y(t.docker);r!==void 0&&a.push({name:t.name,docker:r,isLambda:!1})}return a}s(D,"parseDockerServicesFromManifest");function X(n){const e=new Map;for(const{name:a,imageKey:t,docker:r,architecture:i}of b(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:r,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(r)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${a}").`)}return Array.from(e.values())}s(X,"parseLambdaDockerServicesFromManifest");function b(n){const e=g(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const a=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const r=y(t.docker);if(r===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&(C.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),a.push({name:t.name,imageKey:i,docker:r,...o!==void 0&&{architecture:o}})}return a}s(b,"parseLambdaDockerEntriesFromManifest");function Y(n){const e=D(n),a=b(n);return{ecsServices:e,lambdaEntries:a,declaresBuild:e.length>0||a.length>0}}s(Y,"parseDockerDeclarationsFromManifest");function Z(n){const e=m(n,l);let a;try{a=p(e,"utf-8")}catch(i){const o=i.code;return o==="ENOENT"?{outcome:"ok",tags:[]}:{outcome:"manifest-unreadable",reason:`manifest at ${e} exists but could not be read (${o??"unknown error"})`}}let t;try{t=JSON.parse(a)}catch{return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not valid JSON`}}if(!u(t))return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not a JSON object`};if(t.services===void 0)return{outcome:"ok",tags:[]};if(!Array.isArray(t.services))return{outcome:"manifest-unreadable",reason:`manifest at ${e} has a non-array \`services\` field`};const r=new Set;for(const i of t.services)if(u(i)&&i.schemaGateImageTag!==void 0){if(typeof i.schemaGateImageTag!="string"||i.schemaGateImageTag==="")return{outcome:"manifest-unreadable",reason:`manifest at ${e} declares an invalid schemaGateImageTag for service '${typeof i.name=="string"?i.name:"<unnamed>"}'`};r.add(i.schemaGateImageTag)}return{outcome:"ok",tags:[...r].sort()}}s(Z,"parseSchemaGateImageTagsFromManifest");export{q as createEmptyManifest,h as getManifestFilePath,Y as parseDockerDeclarationsFromManifest,D as parseDockerServicesFromManifest,b as parseLambdaDockerEntriesFromManifest,X as parseLambdaDockerServicesFromManifest,Z as parseSchemaGateImageTagsFromManifest,z as readConstructMap,Q as readEngineCompatEnvelope,W as readManifestAppName,$ as readManifestAppNameOutcome,I as readManifestFile,O as readManifestFileOutcome,U as writeManifestFile};
+var M=Object.defineProperty;var s=(n,e)=>M(n,"name",{value:e,configurable:!0});import{readFile as k,writeFile as E,unlink as N,rename as S,mkdir as w}from"fs/promises";import{readFileSync as p}from"fs";import{dirname as F,join as m}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as x}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as A}from"../constructMap.js";import{FjallManifestSchema as v,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as j,normaliseDockerBuild as y,LAMBDA_ARCHITECTURE_VALUES as C}from"./schemas.js";function h(n){return m(n,l)}s(h,"getManifestFilePath");async function O(n){const e=h(n);if(!await x(e))return{status:"absent"};try{const r=await k(e,"utf-8"),t=JSON.parse(r),a=v.safeParse(t);if(!a.success){const i=f(a.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:a.data}}catch(r){const t=f(d(r));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(O,"readManifestFileOutcome");async function I(n){const e=await O(n);return e.status==="ok"?e.manifest:null}s(I,"readManifestFile");async function U(n,e){const r=h(n),t=`${r}.${Date.now()}.tmp`;await w(F(r),{recursive:!0});try{await E(t,JSON.stringify(e,null,2),"utf-8"),await S(t,r)}catch(a){try{await N(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw a}}s(U,"writeManifestFile");function q(n){return{version:j,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(q,"createEmptyManifest");async function z(n){const e=await I(n);return e?.resourceMap?A(e.resourceMap):new Map}s(z,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function g(n,e){const r=m(n,l);let t;try{t=p(r,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:r});return}let a;try{a=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:r});return}return u(a)?a:void 0}s(g,"readManifestRecord");function T(n){const e=n.engineCompat;if(!u(e))return;const r=e.minimumEngineVersion;if(typeof r!="string"||r.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",a=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:r,...a!==void 0&&{maximumEngineMajor:a},...o!==void 0&&{minimumAwsCdkCli:o}}}s(T,"extractEngineCompat");function Q(n){const e=g(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const r=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),a=T(e);return{manifestVersion:r,engineCompatPresent:t,engineCompat:a}}s(Q,"readEngineCompatEnvelope");function W(n){const e=$(n);return e.status==="ok"?e.appName:void 0}s(W,"readManifestAppName");function $(n){const e=m(n,l);let r;try{r=p(e,"utf-8")}catch(a){const i=a!==null&&typeof a=="object"&&"code"in a?a.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"})}let t;try{t=JSON.parse(r)}catch(a){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s($,"readManifestAppNameOutcome");function D(n){const e=g(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const r=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);a!==void 0&&r.push({name:t.name,docker:a,isLambda:!1,...typeof t.clusterName=="string"&&{clusterName:t.clusterName}})}return r}s(D,"parseDockerServicesFromManifest");function X(n){const e=new Map;for(const{name:r,imageKey:t,docker:a,architecture:i}of b(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:a,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(a)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${r}").`)}return Array.from(e.values())}s(X,"parseLambdaDockerServicesFromManifest");function b(n){const e=g(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const r=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);if(a===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&(C.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),r.push({name:t.name,imageKey:i,docker:a,...o!==void 0&&{architecture:o}})}return r}s(b,"parseLambdaDockerEntriesFromManifest");function Y(n){const e=D(n),r=b(n);return{ecsServices:e,lambdaEntries:r,declaresBuild:e.length>0||r.length>0}}s(Y,"parseDockerDeclarationsFromManifest");function Z(n){const e=m(n,l);let r;try{r=p(e,"utf-8")}catch(i){const o=i.code;return o==="ENOENT"?{outcome:"ok",tags:[]}:{outcome:"manifest-unreadable",reason:`manifest at ${e} exists but could not be read (${o??"unknown error"})`}}let t;try{t=JSON.parse(r)}catch{return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not valid JSON`}}if(!u(t))return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not a JSON object`};if(t.services===void 0)return{outcome:"ok",tags:[]};if(!Array.isArray(t.services))return{outcome:"manifest-unreadable",reason:`manifest at ${e} has a non-array \`services\` field`};const a=new Set;for(const i of t.services)if(u(i)&&i.schemaGateImageTag!==void 0){if(typeof i.schemaGateImageTag!="string"||i.schemaGateImageTag==="")return{outcome:"manifest-unreadable",reason:`manifest at ${e} declares an invalid schemaGateImageTag for service '${typeof i.name=="string"?i.name:"<unnamed>"}'`};a.add(i.schemaGateImageTag)}return{outcome:"ok",tags:[...a].sort()}}s(Z,"parseSchemaGateImageTagsFromManifest");export{q as createEmptyManifest,h as getManifestFilePath,Y as parseDockerDeclarationsFromManifest,D as parseDockerServicesFromManifest,b as parseLambdaDockerEntriesFromManifest,X as parseLambdaDockerServicesFromManifest,Z as parseSchemaGateImageTagsFromManifest,z as readConstructMap,Q as readEngineCompatEnvelope,W as readManifestAppName,$ as readManifestAppNameOutcome,I as readManifestFile,O as readManifestFileOutcome,U as writeManifestFile};

package/dist/naming/applicationStackNames.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Application infrastructure stacks.
+ *
+ * UsEast1Certificates is the app-owned us-east-1 certificate stack (domain
+ * gold-plating D3, BYO CloudFront path — components/infrastructure
+ * `App.getUsEast1CertificateStack`). It exists only when a CloudFront-facing
+ * pattern carries a custom domain outside us-east-1, so ordering derivations
+ * include it ONLY when the post-synth manifest proves it
+ * (`AppResourceFlags.hasUsEast1Certificates`) — a fixed-set entry would make
+ * every deploy attempt a stack that does not exist. It must deploy BEFORE Cdn
+ * (the distribution consumes its certificate ARN through cross-region
+ * references) and destroy AFTER Cdn.
+ *
+ * UsEast1CdnLogging is the app-owned us-east-1 CloudFront standard-logging
+ * (v2) stack (components/infrastructure `App.getUsEast1CdnLoggingStack`).
+ * CloudWatch vends CloudFront delivery sources, destinations and deliveries
+ * in us-east-1 only, so a logging CDN whose app deploys elsewhere creates
+ * them there. It CONSUMES the Cdn stack's distribution and bucket ARNs
+ * through cross-region references, so it is the mirror of the certificate
+ * stack: it deploys AFTER Cdn and is destroyed BEFORE it, and it is likewise
+ * conditional — a CDN in a us-east-1 app never creates it.
+ */
+export declare const APPLICATION_STACKS: {
+    readonly NETWORK: "Network";
+    readonly DATABASE: "Database";
+    readonly STORAGE: "Storage";
+    readonly COMPUTE: "Compute";
+    readonly US_EAST_1_CERTIFICATES: "UsEast1Certificates";
+    readonly CDN: "Cdn";
+    readonly US_EAST_1_CDN_LOGGING: "UsEast1CdnLogging";
+    readonly MESSAGING: "Messaging";
+};
+export type ApplicationStack = (typeof APPLICATION_STACKS)[keyof typeof APPLICATION_STACKS];
+export declare function isApplicationStack(value: string): value is ApplicationStack;
+/**
+ * CloudFormation stack name of one of an application's stacks.
+ *
+ * This is the derivation `@fjall/components-infrastructure` uses to NAME the
+ * stack at synth (`App` keys every stack on `toPascalCase(appName)` and the
+ * stack id is the CloudFormation stack name), so it is the only way runtime
+ * code may address one: a re-implementation agrees with the construct for a
+ * lowercase app name and diverges for `billing-api` or `WebApp`, which is how
+ * a hand-rolled `${appName}Network` shipped through typecheck and every
+ * kebab-named fixture before failing for the first hyphenated app. Both sides
+ * call this function; neither composes the string.
+ */
+export declare function getApplicationStackName(appName: string, stack: ApplicationStack): string;

package/dist/naming/applicationStackNames.js

@@ -0,0 +1 @@
+var A=Object.defineProperty;var a=(t,e)=>A(t,"name",{value:e,configurable:!0});import{toPascalCase as S}from"./caseConversion.js";const o={NETWORK:"Network",DATABASE:"Database",STORAGE:"Storage",COMPUTE:"Compute",US_EAST_1_CERTIFICATES:"UsEast1Certificates",CDN:"Cdn",US_EAST_1_CDN_LOGGING:"UsEast1CdnLogging",MESSAGING:"Messaging"},n=new Set(Object.values(o));function i(t){return n.has(t)}a(i,"isApplicationStack");function r(t,e){return`${S(t)}${e}`}a(r,"getApplicationStackName");export{o as APPLICATION_STACKS,r as getApplicationStackName,i as isApplicationStack};

package/dist/naming/stackExportNames.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Export names an application's own stacks emit for the runtime to read back.
+ *
+ * These names are a contract between `@fjall/components-infrastructure`,
+ * which emits them as CloudFormation exports at synth, and the runtime
+ * consumers that address the live resources they name: deploy-core's
+ * `EcsServiceResolver` (the ECS services `fjall services`, `fjall rollout`,
+ * a code-only deploy, a rollback and a restart act on) and the fjall.io
+ * webapp's VPC CIDR capture. Both sides MUST call these functions rather than
+ * compose or pattern-match the string themselves. The producer once built
+ * the service name from `toPascalCase(appName)` while the consumer searched
+ * exports for the app name as written, so no hyphenated app could resolve
+ * its services; and a substring match on the consumer side returned a
+ * sibling app's services whenever one name contained the other.
+ *
+ * Every builder takes RAW names — the CloudFormation stack name, the
+ * cluster's construct id, the service's manifest name, the VPC's construct
+ * id — never a pre-sanitised token, so the two sides cannot normalise
+ * differently. `stackName` is the stack the output lives in
+ * (`getApplicationStackName`), which is what makes the name unique per
+ * account and region: export names are a flat namespace, and a name built
+ * only from the literal ids inside a pattern is shared by every app that
+ * uses that pattern.
+ *
+ * The `is*ExportName` predicates identify an output that CLAIMS the contract
+ * (they read the marker suffix, case-sensitively). A consumer that selects
+ * by predicate must then verify the claim by rebuilding the name from the
+ * output's own value and refuse the output when the two disagree — the
+ * predicate is a filter, never proof.
+ */
+/**
+ * Qualify an export name with the stack that emits it. The suffix stays
+ * last: every builder below composes through this function, and the
+ * predicates read the tail.
+ */
+export declare function stackScopedExportName(stackName: string, suffix: string): string;
+export declare const DEPLOYABLE_SERVICE_EXPORT_MARKER = "DeployableService";
+export declare const DEPLOYABLE_CLUSTER_EXPORT_MARKER = "DeployableCluster";
+export declare const CLUSTER_ARN_EXPORT_MARKER = "ClusterArn";
+export declare const VPC_CIDR_EXPORT_MARKER = "-vpc-cidr";
+/**
+ * Export carrying the ARN of one deployable ECS service.
+ *
+ * `clusterName` is the ECS cluster's construct id, which is also its physical
+ * cluster name; `serviceName` is the service's manifest name, which is also
+ * its physical ECS service name. Both therefore reappear verbatim in the
+ * exported ARN (`…:service/<clusterName>/<serviceName>`), so a consumer can
+ * rebuild this name from the ARN alone and check the export against it.
+ */
+export declare function deployableServiceExportName(stackName: string, clusterName: string, serviceName: string): string;
+/**
+ * The unqualified form constructs 2.0.0 through 7.x emitted, before 8.0.0
+ * qualified every export with its stack. Consumers accept it so an app last
+ * deployed on those versions still resolves; nothing emits it any more.
+ */
+export declare function legacyDeployableServiceExportName(clusterName: string, serviceName: string): string;
+export declare function isDeployableServiceExportName(exportName: string): boolean;
+/** Export carrying the ARN of a cluster that holds deployable services. */
+export declare function deployableClusterExportName(stackName: string, clusterName: string): string;
+/** Export carrying an ECS cluster's ARN under its plain name. */
+export declare function clusterArnExportName(stackName: string, clusterName: string): string;
+/**
+ * Construct id of the VPC `App.getApp(name, { network })` creates in the
+ * app's Network stack — the id the VPC CIDR export is keyed on.
+ */
+export declare function defaultVpcConstructId(appName: string): string;
+/**
+ * Export carrying a VPC's CIDR block. The construct id is load-bearing: a
+ * stack holding two VPCs (`app.addNetwork`) would otherwise emit one name
+ * twice, and CloudFormation rejects the template.
+ */
+export declare function vpcCidrExportName(stackName: string, vpcConstructId: string): string;
+/**
+ * The form constructs before 8.0.0 emitted, keyed on the stack alone.
+ * Accepted by consumers for apps last deployed on those versions.
+ */
+export declare function legacyVpcCidrExportName(stackName: string): string;
+export declare function isVpcCidrExportName(exportName: string): boolean;

package/dist/naming/stackExportNames.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var t=(e,r)=>u(e,"name",{value:r,configurable:!0});import{toPascalCase as E}from"./caseConversion.js";function o(e,r){return`${e}${r}`}t(o,"stackScopedExportName");const n="DeployableService",i="DeployableCluster",x="ClusterArn",p="-vpc-cidr";function R(e,r,c){return o(e,`${r}${c}${n}`)}t(R,"deployableServiceExportName");function s(e,r){return`${e}${r}${n}`}t(s,"legacyDeployableServiceExportName");function $(e){return e.endsWith(n)}t($,"isDeployableServiceExportName");function C(e,r){return o(e,`${r}${i}`)}t(C,"deployableClusterExportName");function f(e,r){return o(e,`${r}${x}`)}t(f,"clusterArnExportName");function _(e){return`${E(e)}Vpc`}t(_,"defaultVpcConstructId");function d(e,r){return o(e,`${r}${p}`)}t(d,"vpcCidrExportName");function m(e){return o(e,p)}t(m,"legacyVpcCidrExportName");function N(e){return e.endsWith(p)}t(N,"isVpcCidrExportName");export{x as CLUSTER_ARN_EXPORT_MARKER,i as DEPLOYABLE_CLUSTER_EXPORT_MARKER,n as DEPLOYABLE_SERVICE_EXPORT_MARKER,p as VPC_CIDR_EXPORT_MARKER,f as clusterArnExportName,_ as defaultVpcConstructId,C as deployableClusterExportName,R as deployableServiceExportName,$ as isDeployableServiceExportName,N as isVpcCidrExportName,s as legacyDeployableServiceExportName,m as legacyVpcCidrExportName,o as stackScopedExportName,d as vpcCidrExportName};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "38.0.0",
+  "version": "39.0.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -178,7 +178,7 @@
     "prettier": "^3.9.6",
     "tsc-watch": "^7.2.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "zod": "^4.4.3"