@fjall/util 39.0.8 → 39.0.10

package/dist/.minified

@@ -1 +1 @@
-143 files minified at 2026-10-15T04:00:00.597Z
+148 files minified at 2026-11-01T19:17:02.289Z

package/dist/cdkStreamNoise.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Which lines of a CDK child's output can carry a failure's cause, and the
+ * prefixes of the lines the constructs' `FjallLogger` writes.
+ *
+ * Noise is judged line by line over the whole stream, never on a chunk: a
+ * chunk is an arbitrary slice of the stream, so a test on one drops whatever
+ * shares it. Every judgement is anchored at the start of a line, so a cause
+ * whose own text names a noise word is kept.
+ *
+ * A process warning that spans several lines keeps all but its first: only
+ * the `(node:N) ` head is recognisable. The CDK child runs with
+ * `NODE_NO_WARNINGS=1`, which suppresses those warnings at source.
+ *
+ * Imports nothing, so the root barrel stays browser-safe.
+ */
+/** Opens each line `FjallLogger.warn` writes. */
+export declare const FJALL_WARNING_PREFIX = "[Fjall] Warning: ";
+/** Opens each line `FjallLogger.info` writes. */
+export declare const FJALL_NOTE_PREFIX = "[Fjall] Note: ";
+/**
+ * The lines of `stream` that can carry a failure's cause, in order. Dropped
+ * are Node process warnings, npm warnings, an `aws-cdk-lib` `[WARNING] `
+ * notice with its indented continuation, `FjallLogger`'s warning and note
+ * lines, and the CDK CLI's `AI agent detected`. Blank lines are kept.
+ */
+export declare function cdkDiagnosticLines(stream: string): string[];

package/dist/cdkStreamNoise.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var o=(t,n)=>i(t,"name",{value:n,configurable:!0});const r="[Fjall] Warning: ",a="[Fjall] Note: ",c=[/^\(node:\d+\) /,/^\(Use `[^`]+ --trace-(?:warnings|deprecation) \.\.\.` to show where the warning was created\)$/,/^npm (?:WARN|warn) /,/^AI agent detected$/],N="[WARNING] ",I=/^\s+\S/;function A(t){return t.startsWith(r)||t.startsWith(a)||c.some(n=>n.test(t))}o(A,"isNoiseLine");function W(t){const n=[];let s=!1;for(const e of t.split(/\r?\n/)){if(e.startsWith(N)){s=!0;continue}s&&I.test(e)||(s=!1,A(e)||n.push(e))}return n}o(W,"cdkDiagnosticLines");export{a as FJALL_NOTE_PREFIX,r as FJALL_WARNING_PREFIX,W as cdkDiagnosticLines};

package/dist/cdkToolchain.d.ts

@@ -12,7 +12,7 @@
  */
 export declare const BLESSED_CDK_TOOLCHAIN: {
     readonly "aws-cdk": "2.1134.0";
-    readonly "aws-cdk-lib": "2.265.0";
+    readonly "aws-cdk-lib": "2.273.0";
     readonly "@aws-cdk/cloudformation-diff": "2.187.2";
     readonly constructs: "10.8.0";
 };

package/dist/cdkToolchain.js

@@ -1 +1 @@
-const c={"aws-cdk":"2.1134.0","aws-cdk-lib":"2.265.0","@aws-cdk/cloudformation-diff":"2.187.2",constructs:"10.8.0"};export{c as BLESSED_CDK_TOOLCHAIN};
+const c={"aws-cdk":"2.1134.0","aws-cdk-lib":"2.273.0","@aws-cdk/cloudformation-diff":"2.187.2",constructs:"10.8.0"};export{c as BLESSED_CDK_TOOLCHAIN};

package/dist/config.js

@@ -1,2 +1,2 @@
-var O=Object.defineProperty;var T=(w,e)=>O(w,"name",{value:e,configurable:!0});import*as o from"fs";import*as i from"path";import{z as y}from"zod";import{failure as d,success as u}from"./docker/result.js";import{getErrorMessage as h}from"./errorUtils.js";import{logger as p}from"./logger.js";import{maskSensitiveOutput as m}from"./securityHelpers.js";import{mergeRootConfig as S,readRootConfigForMerge as A}from"./rootConfigMerge.js";import{RootConfigReadSchema as v,RootConfigSchema as L,serialiseRootConfig as R}from"./rootConfigSchema.js";import{DomainConfigSchema as ae,OrganisationBindingSchema as se,ROOT_CONFIG_KEYS as ce,RootConfigReadSchema as le,RootConfigSchema as fe,serialiseRootConfig as de}from"./rootConfigSchema.js";import{mergeRootConfig as ue,mergeRootConfigContent as he,readRootConfigForMerge as me}from"./rootConfigMerge.js";import{ensureGitignoreEntries as _}from"./scaffold/ensureGitignore.js";import{FJALL_MANAGED_STATE_DIR_ENTRIES as F,FJALL_PROJECT_GITIGNORE_HEADER as j,LOCAL_CONFIG_GITIGNORE_ENTRY as D,LOCAL_STATE_GITIGNORE_MARKER as I}from"./scaffold/gitignore.js";import{LOCAL_CONFIG_DIRNAME as N,LOCAL_CONFIG_FILENAME as $,ROOT_CONFIG_FILENAME as C}from"./configPaths.js";import{LOCAL_CONFIG_DIRNAME as pe,LOCAL_CONFIG_FILENAME as ye,ROOT_CONFIG_FILENAME as Ee}from"./configPaths.js";const M=10,Z=["compliance","governance","none"],z=["enforced","off"],V=["centralised","off"],X=["account","draining","org"],q="managementEvents",Q="organisationManagementEvents",ee=["active","draining","removed"],te="FjallTrailBucketName",re="FjallTrailKeyArn",oe="OrganisationTrailBucketName",b=y.object({activeTarget:y.string().optional()});class n{static{T(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};searchStartDir;constructor(e,t){this.rootConfig=e??{},this.configPath=t??null}static findConfigDirectory(e){let t=e!==void 0&&e!==""?e:process.cwd();for(let r=0;r<M;r++){const a=i.join(t,"fjall"),f=i.join(a,C);if(o.existsSync(f))return a;const c=i.join(t,C);if(o.existsSync(c))return t;const s=i.dirname(t);if(s===t)break;t=s}return null}static loadConfigFile(e){try{return o.accessSync(e,o.constants.R_OK),o.readFileSync(e,{encoding:"utf8"})}catch(t){return p.warn("Config",`Config file at ${e} could not be read; using defaults`,{file:e,error:m(h(t))}),null}}static loadConfig(e){const t=n.findConfigDirectory(e);if(!t){const l=new n;return l.searchStartDir=e,l}const r=i.join(t,C),a=n.loadConfigFile(r);if(a===null){const l=new n(void 0,r);return l.searchStartDir=e,l.loadFailed=!0,l}let f,c=!1;if(a!==""){let l;try{l=JSON.parse(a)}catch(g){throw n.formatZodError(g,C)}const E=L.safeParse(l);if(E.success)f=E.data;else{const g=v.safeParse(l);f=g.success?g.data:{},c=!g.success,g.success?p.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains, capacityIdentity and organisation are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:r}):p.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:r})}}const s=new n(f,r);return s.searchStartDir=e,s.parseDegraded=c,s.loadedSnapshot=structuredClone(s.rootConfig),s}static formatZodError(e,t){if(e instanceof y.ZodError&&e.issues.length>0){const f=e.issues.map(c=>`${c.path.join(".")}: ${c.message}`).join("; ");return new Error(`Failed to parse ${t}: ${f}`)}const a=(e instanceof Error?e.message:String(e)).replace(/\n/g," ").substring(0,500);return new Error(`Failed to parse ${t}: ${a}`)}saveConfig(){const e=i.join(this.resolveProjectDirectory()??i.join(this.searchStartDir??process.cwd(),"fjall"),C);if(this.loadFailed)return d(new Error(`Refusing to save ${e}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${e}) and retry.`));const t=i.dirname(e);try{o.mkdirSync(t,{recursive:!0})}catch(s){return d(new Error(`Cannot create config directory ${t}: ${m(h(s))}`))}const r=n.assertWritable(e,t);if(!r.success)return r;const a=this.mergeWithDisk(e);if(!a.success)return a;const f=R(a.data),c=`${e}.tmp-${process.pid}`;try{o.writeFileSync(c,f,{mode:384}),o.renameSync(c,e)}catch(s){return d(new Error(`Failed to save ${e}: ${m(h(s))}`))}return this.configPath=e,u(void 0)}static assertWritable(e,t){if(o.existsSync(e))try{o.accessSync(e,o.constants.W_OK)}catch{return d(new Error(`Cannot save ${e}: the file is read-only. Make it writable (e.g. chmod u+w ${e}) and retry.`))}try{o.accessSync(t,o.constants.W_OK)}catch{return d(new Error(`Cannot save ${e}: the directory ${t} is not writable. Make it writable (e.g. chmod u+w ${t}) and retry.`))}return u(void 0)}mergeWithDisk(e){const t=n.readDiskConfigForMerge(e);return t.kind==="unmergeable"?d(new Error(`Refusing to save ${e}: ${t.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`)):t.kind==="absent"?u(this.rootConfig):u(S(t.disk,this.rootConfig,this.loadedSnapshot))}static readDiskConfigForMerge(e){if(!o.existsSync(e))return{kind:"absent"};let t;try{t=o.readFileSync(e,{encoding:"utf8"})}catch(r){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${m(h(r))})`}}return A(t)}static getConfigDirectory(e){return n.findConfigDirectory(e)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?i.dirname(this.configPath):n.findConfigDirectory(this.searchStartDir)}localConfigFile(){const e=this.resolveProjectDirectory();return e===null?null:i.join(e,N,$)}loadLocalConfig(){if(this.localConfigCache===void 0){const e=this.localConfigFile();if(e===null)return this.localConfigCache={};try{const t=o.readFileSync(e,{encoding:"utf8"}),r=b.safeParse(JSON.parse(t));this.localConfigCache=r.success?r.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(e){const t=this.localConfigFile();if(t===null)return d(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{o.mkdirSync(i.dirname(t),{recursive:!0});const r=`${t}.tmp-${process.pid}`;o.writeFileSync(r,JSON.stringify(e,null,2)+`
-`,{encoding:"utf8"}),o.renameSync(r,t),_(i.dirname(i.dirname(t)),[D,...F],{header:j,marker:I})}catch(r){return d(new Error(`Failed to write ${t}: ${m(h(r))}`))}return this.localConfigCache=e,u(void 0)}static warnLegacyActiveTargetOnce(){n.warnedLegacyActiveTarget||(n.warnedLegacyActiveTarget=!0,p.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){const e=this.loadLocalConfig().activeTarget;if(e!==void 0)return e;this.rootConfig.activeTarget!==void 0&&n.warnLegacyActiveTargetOnce()}setActiveTarget(e){const t=this.loadLocalConfig();return t.activeTarget=e,this.writeLocalConfig(t)}clearActiveTarget(){const e=this.loadLocalConfig();return delete e.activeTarget,this.writeLocalConfig(e)}getDomains(){return this.rootConfig.domains??[]}setDomains(e){this.rootConfig.domains=e}addDomain(e){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(e)}getDomain(e){return this.rootConfig.domains?.find(t=>t.name.toLowerCase()===e.toLowerCase())}removeDomain(e){if(!this.rootConfig.domains)return!1;const t=this.rootConfig.domains.findIndex(r=>r.name.toLowerCase()===e.toLowerCase());return t===-1?!1:(this.rootConfig.domains.splice(t,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(e){this.rootConfig.organisation=e}clearOrganisation(){delete this.rootConfig.organisation}}export{q as ACCOUNT_TRAIL_NAME,ee as ACCOUNT_TRAIL_STATES,n as Config,ae as DomainConfigSchema,pe as LOCAL_CONFIG_DIRNAME,ye as LOCAL_CONFIG_FILENAME,Q as ORGANISATION_TRAIL_NAME,oe as ORG_TRAIL_BUCKET_OUTPUT_KEY,se as OrganisationBindingSchema,V as ROOT_ACCESS_MANAGEMENT_MODES,Ee as ROOT_CONFIG_FILENAME,ce as ROOT_CONFIG_KEYS,le as RootConfigReadSchema,fe as RootConfigSchema,z as S3_BPA_MODES,te as TRAIL_BUCKET_OUTPUT_KEY,re as TRAIL_KEY_ARN_OUTPUT_KEY,X as TRAIL_LIFECYCLE_STATES,Z as VAULT_LOCK_MODES,ue as mergeRootConfig,he as mergeRootConfigContent,me as readRootConfigForMerge,de as serialiseRootConfig};
+var O=Object.defineProperty;var T=(w,e)=>O(w,"name",{value:e,configurable:!0});import*as o from"fs";import*as i from"path";import{z as y}from"zod";import{failure as d,success as u}from"./docker/result.js";import{getErrorMessage as h}from"./errorUtils.js";import{logger as p}from"./logger.js";import{maskSensitiveOutput as m}from"./securityHelpers.js";import{truncateUtf16Safe as S}from"./textBounds.js";import{mergeRootConfig as A,readRootConfigForMerge as v}from"./rootConfigMerge.js";import{RootConfigReadSchema as L,RootConfigSchema as R,serialiseRootConfig as _}from"./rootConfigSchema.js";import{DomainConfigSchema as ce,OrganisationBindingSchema as le,ROOT_CONFIG_KEYS as fe,RootConfigReadSchema as de,RootConfigSchema as ge,serialiseRootConfig as ue}from"./rootConfigSchema.js";import{mergeRootConfig as me,mergeRootConfigContent as Ce,readRootConfigForMerge as pe}from"./rootConfigMerge.js";import{ensureGitignoreEntries as F}from"./scaffold/ensureGitignore.js";import{FJALL_MANAGED_STATE_DIR_ENTRIES as j,FJALL_PROJECT_GITIGNORE_HEADER as D,LOCAL_CONFIG_GITIGNORE_ENTRY as I,LOCAL_STATE_GITIGNORE_MARKER as N}from"./scaffold/gitignore.js";import{LOCAL_CONFIG_DIRNAME as $,LOCAL_CONFIG_FILENAME as k,ROOT_CONFIG_FILENAME as C}from"./configPaths.js";import{LOCAL_CONFIG_DIRNAME as Ee,LOCAL_CONFIG_FILENAME as Te,ROOT_CONFIG_FILENAME as we}from"./configPaths.js";const x=10,V=["compliance","governance","none"],X=["enforced","off"],q=["centralised","off"],Q=["account","draining","org"],ee="managementEvents",te="organisationManagementEvents",re=["active","draining","removed"],oe="FjallTrailBucketName",ne="FjallTrailKeyArn",ie="OrganisationTrailBucketName",M=y.object({activeTarget:y.string().optional()});class n{static{T(this,"Config")}rootConfig;configPath=null;loadFailed=!1;parseDegraded=!1;loadedSnapshot={};searchStartDir;constructor(e,t){this.rootConfig=e??{},this.configPath=t??null}static findConfigDirectory(e){let t=e!==void 0&&e!==""?e:process.cwd();for(let r=0;r<x;r++){const a=i.join(t,"fjall"),f=i.join(a,C);if(o.existsSync(f))return a;const c=i.join(t,C);if(o.existsSync(c))return t;const s=i.dirname(t);if(s===t)break;t=s}return null}static loadConfigFile(e){try{return o.accessSync(e,o.constants.R_OK),o.readFileSync(e,{encoding:"utf8"})}catch(t){return p.warn("Config",`Config file at ${e} could not be read; using defaults`,{file:e,error:m(h(t))}),null}}static loadConfig(e){const t=n.findConfigDirectory(e);if(!t){const l=new n;return l.searchStartDir=e,l}const r=i.join(t,C),a=n.loadConfigFile(r);if(a===null){const l=new n(void 0,r);return l.searchStartDir=e,l.loadFailed=!0,l}let f,c=!1;if(a!==""){let l;try{l=JSON.parse(a)}catch(g){throw n.formatZodError(g,C)}const E=R.safeParse(l);if(E.success)f=E.data;else{const g=L.safeParse(l);f=g.success?g.data:{},c=!g.success,g.success?p.warn("Config","fjall-config.json contains keys this version does not recognise (only activeTarget, domains, capacityIdentity and organisation are read). They were most likely written by a newer fjall version \u2014 leave them in place; saves preserve them verbatim.",{file:r}):p.warn("Config","fjall-config.json has a malformed activeTarget, domains or capacityIdentity value, so its contents were ignored for this run \u2014 any capacity-identity pins it holds will NOT apply (a pinned stack deploys unpinned and is blocked by the rename gate). Fix the file by hand; do NOT regenerate it, which would discard the pins.",{file:r})}}const s=new n(f,r);return s.searchStartDir=e,s.parseDegraded=c,s.loadedSnapshot=structuredClone(s.rootConfig),s}static formatZodError(e,t){if(e instanceof y.ZodError&&e.issues.length>0){const f=e.issues.map(c=>`${c.path.join(".")}: ${c.message}`).join("; ");return new Error(`Failed to parse ${t}: ${f}`)}const r=e instanceof Error?e.message:String(e),a=S(r.replace(/\n/g," "),500);return new Error(`Failed to parse ${t}: ${a}`)}saveConfig(){const e=i.join(this.resolveProjectDirectory()??i.join(this.searchStartDir??process.cwd(),"fjall"),C);if(this.loadFailed)return d(new Error(`Refusing to save ${e}: the file exists but could not be read when this config loaded, so saving would replace its contents with state that never included them. Fix the file permissions (e.g. chmod u+rw ${e}) and retry.`));const t=i.dirname(e);try{o.mkdirSync(t,{recursive:!0})}catch(s){return d(new Error(`Cannot create config directory ${t}: ${m(h(s))}`))}const r=n.assertWritable(e,t);if(!r.success)return r;const a=this.mergeWithDisk(e);if(!a.success)return a;const f=_(a.data),c=`${e}.tmp-${process.pid}`;try{o.writeFileSync(c,f,{mode:384}),o.renameSync(c,e)}catch(s){return d(new Error(`Failed to save ${e}: ${m(h(s))}`))}return this.configPath=e,u(void 0)}static assertWritable(e,t){if(o.existsSync(e))try{o.accessSync(e,o.constants.W_OK)}catch{return d(new Error(`Cannot save ${e}: the file is read-only. Make it writable (e.g. chmod u+w ${e}) and retry.`))}try{o.accessSync(t,o.constants.W_OK)}catch{return d(new Error(`Cannot save ${e}: the directory ${t} is not writable. Make it writable (e.g. chmod u+w ${t}) and retry.`))}return u(void 0)}mergeWithDisk(e){const t=n.readDiskConfigForMerge(e);return t.kind==="unmergeable"?d(new Error(`Refusing to save ${e}: ${t.reason}. Writing now would keep only this session's state and drop everything else the file carries (including keys written by other fjall versions). Fix or remove the file and retry.`)):t.kind==="absent"?u(this.rootConfig):u(A(t.disk,this.rootConfig,this.loadedSnapshot))}static readDiskConfigForMerge(e){if(!o.existsSync(e))return{kind:"absent"};let t;try{t=o.readFileSync(e,{encoding:"utf8"})}catch(r){return{kind:"unmergeable",reason:`the existing file could not be read or parsed as JSON (${m(h(r))})`}}return v(t)}static getConfigDirectory(e){return n.findConfigDirectory(e)}getConfigPath(){return this.configPath}isContentUnavailable(){return this.loadFailed||this.parseDegraded}static warnedLegacyActiveTarget=!1;localConfigCache;resolveProjectDirectory(){return this.configPath!==null?i.dirname(this.configPath):n.findConfigDirectory(this.searchStartDir)}localConfigFile(){const e=this.resolveProjectDirectory();return e===null?null:i.join(e,$,k)}loadLocalConfig(){if(this.localConfigCache===void 0){const e=this.localConfigFile();if(e===null)return this.localConfigCache={};try{const t=o.readFileSync(e,{encoding:"utf8"}),r=M.safeParse(JSON.parse(t));this.localConfigCache=r.success?r.data:{}}catch{this.localConfigCache={}}}return this.localConfigCache}writeLocalConfig(e){const t=this.localConfigFile();if(t===null)return d(new Error("Cannot persist local state: no fjall-config.json was found from this directory, so there is no project to anchor `.fjall/local.json` to. Run this from inside a fjall project, or run `fjall create account` / `fjall create app` first."));try{o.mkdirSync(i.dirname(t),{recursive:!0});const r=`${t}.tmp-${process.pid}`;o.writeFileSync(r,JSON.stringify(e,null,2)+`
+`,{encoding:"utf8"}),o.renameSync(r,t),F(i.dirname(i.dirname(t)),[I,...j],{header:D,marker:N})}catch(r){return d(new Error(`Failed to write ${t}: ${m(h(r))}`))}return this.localConfigCache=e,u(void 0)}static warnLegacyActiveTargetOnce(){n.warnedLegacyActiveTarget||(n.warnedLegacyActiveTarget=!0,p.warn("Config","`activeTarget` in fjall-config.json is deprecated and ignored: a committed target must never re-aim a deploy or CI pipeline. Run `fjall target set <name>` to store it locally in .fjall/local.json, then remove `activeTarget` from the committed fjall-config.json."))}getActiveTarget(){const e=this.loadLocalConfig().activeTarget;if(e!==void 0)return e;this.rootConfig.activeTarget!==void 0&&n.warnLegacyActiveTargetOnce()}setActiveTarget(e){const t=this.loadLocalConfig();return t.activeTarget=e,this.writeLocalConfig(t)}clearActiveTarget(){const e=this.loadLocalConfig();return delete e.activeTarget,this.writeLocalConfig(e)}getDomains(){return this.rootConfig.domains??[]}setDomains(e){this.rootConfig.domains=e}addDomain(e){this.rootConfig.domains||(this.rootConfig.domains=[]),this.rootConfig.domains.push(e)}getDomain(e){return this.rootConfig.domains?.find(t=>t.name.toLowerCase()===e.toLowerCase())}removeDomain(e){if(!this.rootConfig.domains)return!1;const t=this.rootConfig.domains.findIndex(r=>r.name.toLowerCase()===e.toLowerCase());return t===-1?!1:(this.rootConfig.domains.splice(t,1),!0)}getOrganisation(){return this.rootConfig.organisation}setOrganisation(e){this.rootConfig.organisation=e}clearOrganisation(){delete this.rootConfig.organisation}}export{ee as ACCOUNT_TRAIL_NAME,re as ACCOUNT_TRAIL_STATES,n as Config,ce as DomainConfigSchema,Ee as LOCAL_CONFIG_DIRNAME,Te as LOCAL_CONFIG_FILENAME,te as ORGANISATION_TRAIL_NAME,ie as ORG_TRAIL_BUCKET_OUTPUT_KEY,le as OrganisationBindingSchema,q as ROOT_ACCESS_MANAGEMENT_MODES,we as ROOT_CONFIG_FILENAME,fe as ROOT_CONFIG_KEYS,de as RootConfigReadSchema,ge as RootConfigSchema,X as S3_BPA_MODES,oe as TRAIL_BUCKET_OUTPUT_KEY,ne as TRAIL_KEY_ARN_OUTPUT_KEY,Q as TRAIL_LIFECYCLE_STATES,V as VAULT_LOCK_MODES,me as mergeRootConfig,Ce as mergeRootConfigContent,pe as readRootConfigForMerge,ue as serialiseRootConfig};

package/dist/docker/DockerCli.build.js

@@ -1 +1 @@
-var N=Object.defineProperty;var g=(e,n)=>N(e,"name",{value:n,configurable:!0});import{rm as U}from"node:fs/promises";import{buildxArgvBuilder as J}from"./buildxArgvBuilder.js";import{BuildxBuildArgsSchema as Y}from"./dockerCliSchemas.js";import{DEFAULT_REGISTRY_MANIFEST_TIMEOUT_MS as B,DOCKER_CLI_BUILDX_LOG_CATEGORY as S}from"./dockerCliConstants.js";import{abortOrTimeoutError as I,makeLoggedError as p,spawnFailureToError as k,wasAborted as $}from"./dockerCliDiagnostics.js";import{BuildxBuildMonitor as H,buildPhaseTimeoutMessage as K,publishStallTimeoutMessage as P,resolveBuildxBudgets as V}from"./buildxBuildMonitor.js";import{parseMetadataFile as W}from"./metadataFileParser.js";import{parseRawjsonLine as X}from"./rawjsonParser.js";import{rawjsonToVertexEvent as q}from"./rawjsonToVertexEvent.js";import{maskSensitiveOutput as y}from"../securityHelpers.js";import{failure as r,makeError as m,maskOutput as v,runDocker as L,streamDocker as z,success as D}from"./DockerCli.js";function R(e){return e instanceof Error?e.message:String(e)}g(R,"getErrorMessage");async function le(e,n,t,d){const i=Y.safeParse(n);if(!i.success){const o=y(i.error.message);return r(m("validation",`Invalid BuildxBuildArgs: ${o}`,{issues:i.error.issues}))}const s=V(e.env);if(!s.success)return r(m("validation",y(s.error.message)));const x=s.data,u=J(i.data);let f=0,M=0;const C=new Set;let E,T;try{const o=new H(x);E=o,T=i.data.metadataFile;const j=g(b=>{const A=X(b);if(A===null){b.trim()!==""&&e.logger.debug(S,"Skipping malformed rawjson line",{line:y(b)});return}const c=q(A);if(c===null)return;const h=o.observe(c);h!==void 0&&t({type:"status",message:v(h.message),...h.percentage!==void 0&&{percentage:h.percentage}});for(const a of c.vertexes)a.completed!==void 0&&!C.has(a.digest)&&(C.add(a.digest),a.cached===!0?f++:M++),t({type:"vertex",message:v(a.name),vertex:a.digest});for(const a of c.logs)t({type:"log",message:v(a.data),vertex:a.vertex});for(const a of c.statuses)t({type:"status",message:v(`${a.name} ${a.current}`),vertex:a.vertex});for(const a of c.warnings)t({type:"warning",message:v(a.short),vertex:a.vertex})},"onStdoutLine"),G=d!==void 0?AbortSignal.any([o.signal,d]):o.signal,l=await z(e,{args:u,abortSignal:G},j);if(l.spawnError!==void 0)return r(k(e,l));if($(l))return o.timedOutPhase==="build"?r(p(e,"timeout",K(x),{stderrTail:l.stderrTail})):o.timedOutPhase==="publish"?r(p(e,"timeout",P(x,o.progressSummary()),{stderrTail:l.stderrTail})):r(p(e,"abort","docker buildx build was aborted",{stderrTail:l.stderrTail}));if(l.exitCode!==0)return r(p(e,"build_failed",`docker buildx build failed (exit ${l.exitCode})`,{stderrTail:l.stderrTail}));const _=await W(i.data.metadataFile);if(!_.success)return _;const F=_.data,w=F["containerimage.digest"];if(typeof w!="string"||w==="")return r(m("metadata_missing_digest","Buildx metadata file does not contain containerimage.digest",{metadataFile:i.data.metadataFile}));const O={};for(const b of i.data.tags)O[b]=w;return D({digest:w,imageDigests:O,metadata:F,platforms:i.data.platforms,cacheHits:f,cacheMisses:M})}finally{E!==void 0&&E.dispose(),T!==void 0&&await U(T,{force:!0}).catch(o=>{e.logger.warn(S,"Failed to clean up buildx metadata file",{path:T,error:y(R(o))})})}}g(le,"_buildxBuild");async function fe(e,n,t,d){if(n.trim()==="")return r(m("validation","tagByDigest: sourceImage must be non-empty"));if(!t.startsWith("sha256:"))return r(m("validation",`tagByDigest: expected sha256:... digest, got ${t.slice(0,32)}`));if(d.length===0)return r(m("validation","tagByDigest: tags must be a non-empty list"));for(const f of d)if(typeof f!="string"||f.trim()==="")return r(m("validation","tagByDigest: every tag must be non-empty"));const i=`${n}@${t}`,s=[];for(const f of d)s.push("--tag",f);const x=["buildx","imagetools","create","--prefer-index=false",...s,i],u=await L(e,{args:x,timeoutMs:B});return u.spawnError!==void 0?r(k(e,u)):$(u)?r(I(e,u,`docker buildx imagetools create for ${i}`,B)):u.exitCode!==0?r(p(e,"tag_failed",`docker buildx imagetools create for ${i} failed (exit ${u.exitCode})`,{stderrTail:u.stderrTail})):D(void 0)}g(fe,"_tagByDigest");async function me(e,n){const t=await L(e,{args:["buildx","imagetools","inspect",n,"--raw"],timeoutMs:B});if(t.spawnError!==void 0)return r(k(e,t));if($(t))return r(I(e,t,`docker buildx imagetools inspect ${n}`,B));if(t.exitCode!==0)return r(p(e,"inspect_failed",`docker buildx imagetools inspect ${n} failed (exit ${t.exitCode})`,{stderrTail:t.stderrTail}));let d,i;try{const s=JSON.parse(t.stdout);typeof s.mediaType=="string"&&(d=s.mediaType),typeof s.digest=="string"&&(i=s.digest)}catch(s){e.logger.debug(S,"imagetools inspect output is not JSON; preserving raw",{error:y(R(s))})}return D({raw:t.stdout,...d!==void 0&&{mediaType:d},...i!==void 0&&{digest:i}})}g(me,"_imagetoolsInspect");export{le as _buildxBuild,me as _imagetoolsInspect,fe as _tagByDigest};
+var G=Object.defineProperty;var g=(e,n)=>G(e,"name",{value:n,configurable:!0});import{rm as N}from"node:fs/promises";import{buildxArgvBuilder as J}from"./buildxArgvBuilder.js";import{BuildxBuildArgsSchema as Y}from"./dockerCliSchemas.js";import{DEFAULT_REGISTRY_MANIFEST_TIMEOUT_MS as B,DOCKER_CLI_BUILDX_LOG_CATEGORY as _}from"./dockerCliConstants.js";import{abortOrTimeoutError as I,makeLoggedError as p,spawnFailureToError as k,wasAborted as $}from"./dockerCliDiagnostics.js";import{BuildxBuildMonitor as H,buildPhaseTimeoutMessage as K,publishStallTimeoutMessage as P,resolveBuildxBudgets as V}from"./buildxBuildMonitor.js";import{parseMetadataFile as W}from"./metadataFileParser.js";import{parseRawjsonLine as X}from"./rawjsonParser.js";import{rawjsonToVertexEvent as q}from"./rawjsonToVertexEvent.js";import{maskSensitiveOutput as y}from"../securityHelpers.js";import{truncateUtf16Safe as z}from"../textBounds.js";import{failure as r,makeError as m,maskOutput as v,runDocker as L,streamDocker as Q,success as D}from"./DockerCli.js";function R(e){return e instanceof Error?e.message:String(e)}g(R,"getErrorMessage");async function me(e,n,t,d){const i=Y.safeParse(n);if(!i.success){const o=y(i.error.message);return r(m("validation",`Invalid BuildxBuildArgs: ${o}`,{issues:i.error.issues}))}const s=V(e.env);if(!s.success)return r(m("validation",y(s.error.message)));const x=s.data,u=J(i.data);let f=0,M=0;const C=new Set;let E,T;try{const o=new H(x);E=o,T=i.data.metadataFile;const U=g(b=>{const A=X(b);if(A===null){b.trim()!==""&&e.logger.debug(_,"Skipping malformed rawjson line",{line:y(b)});return}const c=q(A);if(c===null)return;const h=o.observe(c);h!==void 0&&t({type:"status",message:v(h.message),...h.percentage!==void 0&&{percentage:h.percentage}});for(const a of c.vertexes)a.completed!==void 0&&!C.has(a.digest)&&(C.add(a.digest),a.cached===!0?f++:M++),t({type:"vertex",message:v(a.name),vertex:a.digest});for(const a of c.logs)t({type:"log",message:v(a.data),vertex:a.vertex});for(const a of c.statuses)t({type:"status",message:v(`${a.name} ${a.current}`),vertex:a.vertex});for(const a of c.warnings)t({type:"warning",message:v(a.short),vertex:a.vertex})},"onStdoutLine"),j=d!==void 0?AbortSignal.any([o.signal,d]):o.signal,l=await Q(e,{args:u,abortSignal:j},U);if(l.spawnError!==void 0)return r(k(e,l));if($(l))return o.timedOutPhase==="build"?r(p(e,"timeout",K(x),{stderrTail:l.stderrTail})):o.timedOutPhase==="publish"?r(p(e,"timeout",P(x,o.progressSummary()),{stderrTail:l.stderrTail})):r(p(e,"abort","docker buildx build was aborted",{stderrTail:l.stderrTail}));if(l.exitCode!==0)return r(p(e,"build_failed",`docker buildx build failed (exit ${l.exitCode})`,{stderrTail:l.stderrTail}));const S=await W(i.data.metadataFile);if(!S.success)return S;const F=S.data,w=F["containerimage.digest"];if(typeof w!="string"||w==="")return r(m("metadata_missing_digest","Buildx metadata file does not contain containerimage.digest",{metadataFile:i.data.metadataFile}));const O={};for(const b of i.data.tags)O[b]=w;return D({digest:w,imageDigests:O,metadata:F,platforms:i.data.platforms,cacheHits:f,cacheMisses:M})}finally{E!==void 0&&E.dispose(),T!==void 0&&await N(T,{force:!0}).catch(o=>{e.logger.warn(_,"Failed to clean up buildx metadata file",{path:T,error:y(R(o))})})}}g(me,"_buildxBuild");async function ce(e,n,t,d){if(n.trim()==="")return r(m("validation","tagByDigest: sourceImage must be non-empty"));if(!t.startsWith("sha256:"))return r(m("validation",`tagByDigest: expected sha256:... digest, got ${z(t,32)}`));if(d.length===0)return r(m("validation","tagByDigest: tags must be a non-empty list"));for(const f of d)if(typeof f!="string"||f.trim()==="")return r(m("validation","tagByDigest: every tag must be non-empty"));const i=`${n}@${t}`,s=[];for(const f of d)s.push("--tag",f);const x=["buildx","imagetools","create","--prefer-index=false",...s,i],u=await L(e,{args:x,timeoutMs:B});return u.spawnError!==void 0?r(k(e,u)):$(u)?r(I(e,u,`docker buildx imagetools create for ${i}`,B)):u.exitCode!==0?r(p(e,"tag_failed",`docker buildx imagetools create for ${i} failed (exit ${u.exitCode})`,{stderrTail:u.stderrTail})):D(void 0)}g(ce,"_tagByDigest");async function ge(e,n){const t=await L(e,{args:["buildx","imagetools","inspect",n,"--raw"],timeoutMs:B});if(t.spawnError!==void 0)return r(k(e,t));if($(t))return r(I(e,t,`docker buildx imagetools inspect ${n}`,B));if(t.exitCode!==0)return r(p(e,"inspect_failed",`docker buildx imagetools inspect ${n} failed (exit ${t.exitCode})`,{stderrTail:t.stderrTail}));let d,i;try{const s=JSON.parse(t.stdout);typeof s.mediaType=="string"&&(d=s.mediaType),typeof s.digest=="string"&&(i=s.digest)}catch(s){e.logger.debug(_,"imagetools inspect output is not JSON; preserving raw",{error:y(R(s))})}return D({raw:t.stdout,...d!==void 0&&{mediaType:d},...i!==void 0&&{digest:i}})}g(ge,"_imagetoolsInspect");export{me as _buildxBuild,ge as _imagetoolsInspect,ce as _tagByDigest};

package/dist/docker/DockerCli.js

@@ -1 +1 @@
-var D=Object.defineProperty;var f=(n,e)=>D(n,"name",{value:e,configurable:!0});import{spawn as y}from"node:child_process";import{filterDangerousEnvVars as C,maskSensitiveOutput as S}from"../securityHelpers.js";import{abortChildProcess as v}from"./abortHelpers.js";import{DEFAULT_DOCKER_BIN as I,DOCKER_CLI_LOG_CATEGORY as L,STDERR_TAIL_LINE_MAX_CHARS as _,STDERR_TAIL_LINES as B}from"./dockerCliConstants.js";import{_buildxBuild as O,_imagetoolsInspect as R,_tagByDigest as P}from"./DockerCli.build.js";import{_assertBuildxAvailable as N,_detectDaemon as G,_ensureBuilder as K}from"./DockerCli.daemon.js";import{_imageInspect as M,_loginEcr as j,_pull as F,_push as H,_tag as U}from"./DockerCli.registry.js";import{failure as T,success as V}from"./result.js";class te{static{f(this,"DockerCli")}state;constructor(e){const t=e.dockerBin!==void 0&&e.dockerBin!==""?e.dockerBin:I,r=C(e.env??process.env);this.state={logger:e.logger,dockerBin:t,env:r,abortSignal:e.abortSignal,ecrSession:void 0}}async buildxBuild(e,t,r){return O(this.state,e,t,r)}async tag(e,t){return U(this.state,e,t)}async tagByDigest(e,t,r){return P(this.state,e,t,r)}async push(e,t){return H(this.state,e,t)}async pull(e,t,r){return F(this.state,e,t,r)}async imageInspect(e){return M(this.state,e)}async imagetoolsInspect(e){return R(this.state,e)}async loginEcr(e){return j(this.state,e)}async logoutEcr(){const e=this.state.ecrSession;this.state.ecrSession=void 0,e!==void 0&&await e.dispose()}async withEcrSession(e,t,r){const i=await this.loginEcr(e);if(!i.success)return T(r(i.error));try{return await t()}finally{await this.logoutEcr().catch(()=>{})}}async ensureBuilder(e){return K(this.state,e)}async assertBuildxAvailable(){return N(this.state)}async detectDaemon(){return G(this.state)}}function X(n){const e=S(n);return e.length>_?e.slice(0,_)+"\u2026":e}f(X,"maskAndBoundStderrTailLine");function re(n,e,t){let r,i=t;if(t!==void 0&&Array.isArray(t.stderrTail)&&t.stderrTail.every(u=>typeof u=="string")){r=t.stderrTail.map(X);const{stderrTail:u,...a}=t;i=Object.keys(a).length>0?a:void 0}return{kind:n,message:e,...r!==void 0&&{stderrTail:r},...i!==void 0&&{details:i}}}f(re,"makeError");function w(n,e){if(n==="")return[];const t=n.split(/\r?\n/);for(;t.length>0&&t[t.length-1]==="";)t.pop();return t.slice(-e)}f(w,"tailLines");function ne(n){return S(n)}f(ne,"maskOutput");function A(n){return n.ecrSession!==void 0?{...n.env,...n.ecrSession.env}:n.env}f(A,"spawnEnv");function ie(n,e){return new Promise(t=>{let r=!1,i=!1,u=!1;const{signal:a,timeoutSignal:h}=k(n.abortSignal,e.timeoutMs,e.abortSignal);let o;try{o=y(n.dockerBin,e.args,{shell:!1,env:A(n)})}catch(s){const d=s instanceof Error?s.message:String(s);t({exitCode:null,stdout:"",stderr:d,stderrTail:[d],aborted:!1,timedOut:!1,spawnError:d});return}let p="",c="";o.stdout?.on("data",s=>{p+=s.toString()}),o.stderr?.on("data",s=>{c+=s.toString()}),e.stdin!==void 0&&(o.stdin?.on("error",s=>{n.logger.debug(L,"stdin write error (typically EPIPE on early child exit)",{error:s.message})}),o.stdin?.write(e.stdin),o.stdin?.end());const m=f(()=>{r=!0,i=h?.aborted===!0,v(o)},"onAbort");a!==void 0&&(a.aborted?m():a.addEventListener("abort",m,{once:!0})),o.once("error",s=>{if(u)return;u=!0,a!==void 0&&a.removeEventListener("abort",m);const d=s instanceof Error?s.message:String(s);t({exitCode:null,stdout:p,stderr:d,stderrTail:[d],aborted:r,timedOut:i,spawnError:d})}),o.once("close",s=>{u||(u=!0,a!==void 0&&a.removeEventListener("abort",m),t({exitCode:s,stdout:p,stderr:c,stderrTail:w(c,B),aborted:r,timedOut:i}))})})}f(ie,"runDocker");function se(n,e,t,r){return new Promise(i=>{let u=!1,a=!1,h=!1;const{signal:o,timeoutSignal:p}=k(n.abortSignal,e.timeoutMs,e.abortSignal);let c;try{c=y(n.dockerBin,e.args,{shell:!1,env:A(n)})}catch(l){const g=l instanceof Error?l.message:String(l);i({exitCode:null,stderrTail:[g],aborted:!1,timedOut:!1,spawnError:g,child:null});return}let m="",s="",d="";c.stdout?.on("data",l=>{m+=l.toString();const g=m.split(/\r?\n/);m=g.pop()??"";for(const b of g)t(b)}),c.stderr?.on("data",l=>{const g=l.toString();if(s+=g,r!==void 0){d+=g;const b=d.split(/\r?\n/);d=b.pop()??"";for(const x of b)r(x)}});const E=f(()=>{u=!0,a=p?.aborted===!0,v(c)},"onAbort");o!==void 0&&(o.aborted?E():o.addEventListener("abort",E,{once:!0})),c.once("error",l=>{if(h)return;h=!0,o!==void 0&&o.removeEventListener("abort",E);const g=l instanceof Error?l.message:String(l);i({exitCode:null,stderrTail:[g],aborted:u,timedOut:a,spawnError:g,child:c})}),c.once("close",l=>{h||(h=!0,m!==""&&t(m),r!==void 0&&d!==""&&r(d),o!==void 0&&o.removeEventListener("abort",E),i({exitCode:l,stderrTail:w(s,B),aborted:u,timedOut:a,child:c}))})})}f(se,"streamDocker");function k(n,e,t){const r=[];n!==void 0&&r.push(n),t!==void 0&&r.push(t);const i=e!==void 0?AbortSignal.timeout(e):void 0;return i!==void 0&&r.push(i),r.length===0?{signal:void 0,timeoutSignal:i}:r.length===1?{signal:r[0],timeoutSignal:i}:{signal:AbortSignal.any(r),timeoutSignal:i}}f(k,"composeAbortSignal");export{te as DockerCli,T as failure,re as makeError,ne as maskOutput,ie as runDocker,se as streamDocker,V as success,w as tailLines};
+var D=Object.defineProperty;var f=(n,e)=>D(n,"name",{value:e,configurable:!0});import{spawn as S}from"node:child_process";import{filterDangerousEnvVars as C,maskSensitiveOutput as y}from"../securityHelpers.js";import{truncateUtf16Safe as I}from"../textBounds.js";import{abortChildProcess as v}from"./abortHelpers.js";import{DEFAULT_DOCKER_BIN as L,DOCKER_CLI_LOG_CATEGORY as O,STDERR_TAIL_LINE_MAX_CHARS as _,STDERR_TAIL_LINES as B}from"./dockerCliConstants.js";import{_buildxBuild as R,_imagetoolsInspect as P,_tagByDigest as N}from"./DockerCli.build.js";import{_assertBuildxAvailable as G,_detectDaemon as K,_ensureBuilder as M}from"./DockerCli.daemon.js";import{_imageInspect as U,_loginEcr as j,_pull as F,_push as H,_tag as V}from"./DockerCli.registry.js";import{failure as T,success as X}from"./result.js";class ne{static{f(this,"DockerCli")}state;constructor(e){const t=e.dockerBin!==void 0&&e.dockerBin!==""?e.dockerBin:L,r=C(e.env??process.env);this.state={logger:e.logger,dockerBin:t,env:r,abortSignal:e.abortSignal,ecrSession:void 0}}async buildxBuild(e,t,r){return R(this.state,e,t,r)}async tag(e,t){return V(this.state,e,t)}async tagByDigest(e,t,r){return N(this.state,e,t,r)}async push(e,t){return H(this.state,e,t)}async pull(e,t,r){return F(this.state,e,t,r)}async imageInspect(e){return U(this.state,e)}async imagetoolsInspect(e){return P(this.state,e)}async loginEcr(e){return j(this.state,e)}async logoutEcr(){const e=this.state.ecrSession;this.state.ecrSession=void 0,e!==void 0&&await e.dispose()}async withEcrSession(e,t,r){const i=await this.loginEcr(e);if(!i.success)return T(r(i.error));try{return await t()}finally{await this.logoutEcr().catch(()=>{})}}async ensureBuilder(e){return M(this.state,e)}async assertBuildxAvailable(){return G(this.state)}async detectDaemon(){return K(this.state)}}function Y(n){const e=y(n);return e.length>_?I(e,_)+"\u2026":e}f(Y,"maskAndBoundStderrTailLine");function ie(n,e,t){let r,i=t;if(t!==void 0&&Array.isArray(t.stderrTail)&&t.stderrTail.every(l=>typeof l=="string")){r=t.stderrTail.map(Y);const{stderrTail:l,...a}=t;i=Object.keys(a).length>0?a:void 0}return{kind:n,message:e,...r!==void 0&&{stderrTail:r},...i!==void 0&&{details:i}}}f(ie,"makeError");function w(n,e){if(n==="")return[];const t=n.split(/\r?\n/);for(;t.length>0&&t[t.length-1]==="";)t.pop();return t.slice(-e)}f(w,"tailLines");function se(n){return y(n)}f(se,"maskOutput");function A(n){return n.ecrSession!==void 0?{...n.env,...n.ecrSession.env}:n.env}f(A,"spawnEnv");function oe(n,e){return new Promise(t=>{let r=!1,i=!1,l=!1;const{signal:a,timeoutSignal:h}=k(n.abortSignal,e.timeoutMs,e.abortSignal);let o;try{o=S(n.dockerBin,e.args,{shell:!1,env:A(n)})}catch(s){const d=s instanceof Error?s.message:String(s);t({exitCode:null,stdout:"",stderr:d,stderrTail:[d],aborted:!1,timedOut:!1,spawnError:d});return}let p="",c="";o.stdout?.on("data",s=>{p+=s.toString()}),o.stderr?.on("data",s=>{c+=s.toString()}),e.stdin!==void 0&&(o.stdin?.on("error",s=>{n.logger.debug(O,"stdin write error (typically EPIPE on early child exit)",{error:s.message})}),o.stdin?.write(e.stdin),o.stdin?.end());const m=f(()=>{r=!0,i=h?.aborted===!0,v(o)},"onAbort");a!==void 0&&(a.aborted?m():a.addEventListener("abort",m,{once:!0})),o.once("error",s=>{if(l)return;l=!0,a!==void 0&&a.removeEventListener("abort",m);const d=s instanceof Error?s.message:String(s);t({exitCode:null,stdout:p,stderr:d,stderrTail:[d],aborted:r,timedOut:i,spawnError:d})}),o.once("close",s=>{l||(l=!0,a!==void 0&&a.removeEventListener("abort",m),t({exitCode:s,stdout:p,stderr:c,stderrTail:w(c,B),aborted:r,timedOut:i}))})})}f(oe,"runDocker");function ae(n,e,t,r){return new Promise(i=>{let l=!1,a=!1,h=!1;const{signal:o,timeoutSignal:p}=k(n.abortSignal,e.timeoutMs,e.abortSignal);let c;try{c=S(n.dockerBin,e.args,{shell:!1,env:A(n)})}catch(u){const g=u instanceof Error?u.message:String(u);i({exitCode:null,stderrTail:[g],aborted:!1,timedOut:!1,spawnError:g,child:null});return}let m="",s="",d="";c.stdout?.on("data",u=>{m+=u.toString();const g=m.split(/\r?\n/);m=g.pop()??"";for(const b of g)t(b)}),c.stderr?.on("data",u=>{const g=u.toString();if(s+=g,r!==void 0){d+=g;const b=d.split(/\r?\n/);d=b.pop()??"";for(const x of b)r(x)}});const E=f(()=>{l=!0,a=p?.aborted===!0,v(c)},"onAbort");o!==void 0&&(o.aborted?E():o.addEventListener("abort",E,{once:!0})),c.once("error",u=>{if(h)return;h=!0,o!==void 0&&o.removeEventListener("abort",E);const g=u instanceof Error?u.message:String(u);i({exitCode:null,stderrTail:[g],aborted:l,timedOut:a,spawnError:g,child:c})}),c.once("close",u=>{h||(h=!0,m!==""&&t(m),r!==void 0&&d!==""&&r(d),o!==void 0&&o.removeEventListener("abort",E),i({exitCode:u,stderrTail:w(s,B),aborted:l,timedOut:a,child:c}))})})}f(ae,"streamDocker");function k(n,e,t){const r=[];n!==void 0&&r.push(n),t!==void 0&&r.push(t);const i=e!==void 0?AbortSignal.timeout(e):void 0;return i!==void 0&&r.push(i),r.length===0?{signal:void 0,timeoutSignal:i}:r.length===1?{signal:r[0],timeoutSignal:i}:{signal:AbortSignal.any(r),timeoutSignal:i}}f(k,"composeAbortSignal");export{ne as DockerCli,T as failure,ie as makeError,se as maskOutput,oe as runDocker,ae as streamDocker,X as success,w as tailLines};

package/dist/failure/deploymentFailure.d.ts

@@ -301,9 +301,9 @@ export declare const DEPLOYMENT_FAULT_COPY: Record<DeploymentFaultAttribution, s
 export declare const DEPLOYMENT_PROVIDER_LABELS: Record<DeploymentFailureProviderSource, string>;
 /**
  * Compose the derived legacy `errorMessage` from a failure record
- * ("title: detail", wire-bounded) — writers persist this alongside `failure`
- * so grep/SQL consumers and pre-taxonomy readers keep working. Webapp mirror:
- * deriveErrorMessageFromFailure at
+ * ("title: detail", wire-bounded and cut between code points) — writers
+ * persist this alongside `failure` so grep/SQL consumers and pre-taxonomy
+ * readers keep working. Webapp mirror: deriveErrorMessageFromFailure at
  * webapp/app/lib/deployment/deployment-failure.ts (same name so the
  * engine-dependency bump swaps the import without a rename).
  */

package/dist/failure/deploymentFailure.js

@@ -1 +1 @@
-var c=Object.defineProperty;var s=(r,o)=>c(r,"name",{value:o,configurable:!0});import{z as e}from"zod";import{FAILURE_ANALYSIS_CATEGORIES as l}from"../aws/failureAnalysisCategories.js";const u=["preflight","credentials","synth","bootstrap","image_build","image_push","cloudformation","ecs_stabilise","platform","unknown"],d=e.enum(u),p=["customer_code","customer_aws","platform","indeterminate"],m=e.enum(p),g=["cloudformation","ecs","ecr","iam","docker","cdk","npm","other"],f=e.enum(g),y=/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/,S=1,t={code:128,title:120,detail:1e3,providerCode:128,providerMessage:2e3,resourceField:256,remediationStep:1024,remediationSteps:10,excerpt:2e3,logRef:512,classifierVersion:32,analysisString:2e3,analysisAffectedResources:50,analysisDependencyChain:50,analysisRemediation:20,analysisDriftSuspects:50,errorMessageWire:2e3,errorMessageDb:1e4},a=e.object({logicalId:e.string(),resourceType:e.string(),status:e.string(),statusReason:e.string().optional(),physicalId:e.string().optional(),timestamp:e.string().optional(),group:e.string().optional(),constructPath:e.string().optional()}),h=e.object({logicalId:e.string(),resourceType:e.string(),physicalId:e.string().optional(),failedStatus:e.string(),statusReason:e.string()}),E=e.object({rootCause:e.object({resource:a,reason:e.string(),category:e.enum(l),isDirectCause:e.boolean()}),affectedResources:e.array(a),dependencyChain:e.array(e.string()),summary:e.string(),remediation:e.array(e.string()),errorPattern:e.string().optional(),driftSuspects:e.array(h).optional()}),R=e.object({source:f,code:e.string().min(1).max(t.providerCode).optional(),message:e.string().max(t.providerMessage)}).strict(),x=e.object({logicalId:e.string().min(1).max(t.resourceField).optional(),resourceType:e.string().min(1).max(t.resourceField).optional(),stackName:e.string().min(1).max(t.resourceField).optional()}).strict(),_=e.object({schemaVersion:e.literal(S),code:e.string().min(1).max(t.code).regex(y,"Failure codes are dotted lowercase keys, e.g. cfn.resource_create_failed"),phase:d,fault:m,title:e.string().min(1).max(t.title),detail:e.string().min(1).max(t.detail),provider:R.optional(),resource:x.optional(),remediation:e.array(e.string().min(1).max(t.remediationStep)).max(t.remediationSteps).default(()=>[]),excerpt:e.string().min(1).max(t.excerpt).optional(),logRef:e.string().min(1).max(t.logRef).optional(),analysis:E.optional(),classifierVersion:e.string().min(1).max(t.classifierVersion)}).strict();function C(r){if(r==null)return null;const o=_.safeParse(r);return o.success?o.data:null}s(C,"parseDeploymentFailure");const D="https://docs.fjall.io/errors";function P(r){return`${D}/${r}`}s(P,"deploymentFailureDocsUrl");const L={platform:"This was a problem on Fjall's side, not in your code or AWS account \u2014 retrying is safe.",customer_aws:"The failure came from your AWS account's configuration, permissions, or limits.",customer_code:"The failure came from the application's code or configuration.",indeterminate:"The cause could not be attributed automatically \u2014 the details below show what was reported."},M={cloudformation:"CloudFormation",ecs:"ECS",ecr:"ECR",iam:"IAM",docker:"Docker",cdk:"CDK",npm:"npm",other:"The provider"};function O(r){const o=`${r.title}: ${r.detail}`;return o.length>t.errorMessageWire?o.slice(0,t.errorMessageWire):o}s(O,"deriveErrorMessageFromFailure");function i(r){return r.length>t.analysisString?r.slice(0,t.analysisString):r}s(i,"truncateAnalysisString");function n(r){return{logicalId:r.logicalId,resourceType:r.resourceType,status:r.status,timestamp:r.timestamp.toISOString(),...r.statusReason!==void 0&&{statusReason:i(r.statusReason)},...r.physicalId!==void 0&&{physicalId:r.physicalId},...r.group!==void 0&&{group:r.group},...r.constructPath!==void 0&&{constructPath:r.constructPath}}}s(n,"toWireResourceEvent");function I(r){return{logicalId:r.logicalId,resourceType:r.resourceType,failedStatus:r.failedStatus,statusReason:i(r.statusReason),...r.physicalId!==void 0&&{physicalId:r.physicalId}}}s(I,"toWireDriftSuspect");function b(r){return{rootCause:{resource:n(r.rootCause.resource),reason:i(r.rootCause.reason),category:r.rootCause.category,isDirectCause:r.rootCause.isDirectCause},affectedResources:r.affectedResources.slice(0,t.analysisAffectedResources).map(n),dependencyChain:r.dependencyChain.slice(0,t.analysisDependencyChain).map(i),summary:i(r.summary),remediation:r.remediation.slice(0,t.analysisRemediation).map(i),...r.errorPattern!==void 0&&{errorPattern:i(r.errorPattern)},...r.driftSuspects!==void 0&&{driftSuspects:r.driftSuspects.slice(0,t.analysisDriftSuspects).map(I)}}}s(b,"toDeploymentFailureAnalysis");export{y as DEPLOYMENT_FAILURE_CODE_PATTERN,D as DEPLOYMENT_FAILURE_DOCS_BASE_URL,t as DEPLOYMENT_FAILURE_LIMITS,u as DEPLOYMENT_FAILURE_PHASES,g as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,S as DEPLOYMENT_FAILURE_SCHEMA_VERSION,p as DEPLOYMENT_FAULT_ATTRIBUTIONS,L as DEPLOYMENT_FAULT_COPY,M as DEPLOYMENT_PROVIDER_LABELS,E as DeploymentFailureAnalysisSchema,d as DeploymentFailurePhaseSchema,R as DeploymentFailureProviderSchema,f as DeploymentFailureProviderSourceSchema,x as DeploymentFailureResourceSchema,_ as DeploymentFailureSchema,m as DeploymentFaultAttributionSchema,P as deploymentFailureDocsUrl,O as deriveErrorMessageFromFailure,C as parseDeploymentFailure,b as toDeploymentFailureAnalysis};
+var u=Object.defineProperty;var o=(r,s)=>u(r,"name",{value:s,configurable:!0});import{z as e}from"zod";import{FAILURE_ANALYSIS_CATEGORIES as l}from"../aws/failureAnalysisCategories.js";import{truncateUtf16Safe as a}from"../textBounds.js";const p=["preflight","credentials","synth","bootstrap","image_build","image_push","cloudformation","ecs_stabilise","platform","unknown"],d=e.enum(p),m=["customer_code","customer_aws","platform","indeterminate"],f=e.enum(m),g=["cloudformation","ecs","ecr","iam","docker","cdk","npm","other"],y=e.enum(g),S=/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/,h=1,t={code:128,title:120,detail:1e3,providerCode:128,providerMessage:2e3,resourceField:256,remediationStep:1024,remediationSteps:10,excerpt:2e3,logRef:512,classifierVersion:32,analysisString:2e3,analysisAffectedResources:50,analysisDependencyChain:50,analysisRemediation:20,analysisDriftSuspects:50,errorMessageWire:2e3,errorMessageDb:1e4},n=e.object({logicalId:e.string(),resourceType:e.string(),status:e.string(),statusReason:e.string().optional(),physicalId:e.string().optional(),timestamp:e.string().optional(),group:e.string().optional(),constructPath:e.string().optional()}),E=e.object({logicalId:e.string(),resourceType:e.string(),physicalId:e.string().optional(),failedStatus:e.string(),statusReason:e.string()}),R=e.object({rootCause:e.object({resource:n,reason:e.string(),category:e.enum(l),isDirectCause:e.boolean()}),affectedResources:e.array(n),dependencyChain:e.array(e.string()),summary:e.string(),remediation:e.array(e.string()),errorPattern:e.string().optional(),driftSuspects:e.array(E).optional()}),x=e.object({source:y,code:e.string().min(1).max(t.providerCode).optional(),message:e.string().max(t.providerMessage)}).strict(),_=e.object({logicalId:e.string().min(1).max(t.resourceField).optional(),resourceType:e.string().min(1).max(t.resourceField).optional(),stackName:e.string().min(1).max(t.resourceField).optional()}).strict(),D=e.object({schemaVersion:e.literal(h),code:e.string().min(1).max(t.code).regex(S,"Failure codes are dotted lowercase keys, e.g. cfn.resource_create_failed"),phase:d,fault:f,title:e.string().min(1).max(t.title),detail:e.string().min(1).max(t.detail),provider:x.optional(),resource:_.optional(),remediation:e.array(e.string().min(1).max(t.remediationStep)).max(t.remediationSteps).default(()=>[]),excerpt:e.string().min(1).max(t.excerpt).optional(),logRef:e.string().min(1).max(t.logRef).optional(),analysis:R.optional(),classifierVersion:e.string().min(1).max(t.classifierVersion)}).strict();function L(r){if(r==null)return null;const s=D.safeParse(r);return s.success?s.data:null}o(L,"parseDeploymentFailure");const I="https://docs.fjall.io/errors";function O(r){return`${I}/${r}`}o(O,"deploymentFailureDocsUrl");const M={platform:"This was a problem on Fjall's side, not in your code or AWS account \u2014 retrying is safe.",customer_aws:"The failure came from your AWS account's configuration, permissions, or limits.",customer_code:"The failure came from the application's code or configuration.",indeterminate:"The cause could not be attributed automatically \u2014 the details below show what was reported."},b={cloudformation:"CloudFormation",ecs:"ECS",ecr:"ECR",iam:"IAM",docker:"Docker",cdk:"CDK",npm:"npm",other:"The provider"};function N(r){return a(`${r.title}: ${r.detail}`,t.errorMessageWire)}o(N,"deriveErrorMessageFromFailure");function i(r){return a(r,t.analysisString)}o(i,"truncateAnalysisString");function c(r){return{logicalId:r.logicalId,resourceType:r.resourceType,status:r.status,timestamp:r.timestamp.toISOString(),...r.statusReason!==void 0&&{statusReason:i(r.statusReason)},...r.physicalId!==void 0&&{physicalId:r.physicalId},...r.group!==void 0&&{group:r.group},...r.constructPath!==void 0&&{constructPath:r.constructPath}}}o(c,"toWireResourceEvent");function T(r){return{logicalId:r.logicalId,resourceType:r.resourceType,failedStatus:r.failedStatus,statusReason:i(r.statusReason),...r.physicalId!==void 0&&{physicalId:r.physicalId}}}o(T,"toWireDriftSuspect");function U(r){return{rootCause:{resource:c(r.rootCause.resource),reason:i(r.rootCause.reason),category:r.rootCause.category,isDirectCause:r.rootCause.isDirectCause},affectedResources:r.affectedResources.slice(0,t.analysisAffectedResources).map(c),dependencyChain:r.dependencyChain.slice(0,t.analysisDependencyChain).map(i),summary:i(r.summary),remediation:r.remediation.slice(0,t.analysisRemediation).map(i),...r.errorPattern!==void 0&&{errorPattern:i(r.errorPattern)},...r.driftSuspects!==void 0&&{driftSuspects:r.driftSuspects.slice(0,t.analysisDriftSuspects).map(T)}}}o(U,"toDeploymentFailureAnalysis");export{S as DEPLOYMENT_FAILURE_CODE_PATTERN,I as DEPLOYMENT_FAILURE_DOCS_BASE_URL,t as DEPLOYMENT_FAILURE_LIMITS,p as DEPLOYMENT_FAILURE_PHASES,g as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,h as DEPLOYMENT_FAILURE_SCHEMA_VERSION,m as DEPLOYMENT_FAULT_ATTRIBUTIONS,M as DEPLOYMENT_FAULT_COPY,b as DEPLOYMENT_PROVIDER_LABELS,R as DeploymentFailureAnalysisSchema,d as DeploymentFailurePhaseSchema,x as DeploymentFailureProviderSchema,y as DeploymentFailureProviderSourceSchema,_ as DeploymentFailureResourceSchema,D as DeploymentFailureSchema,f as DeploymentFaultAttributionSchema,O as deploymentFailureDocsUrl,N as deriveErrorMessageFromFailure,L as parseDeploymentFailure,U as toDeploymentFailureAnalysis};

package/dist/failure/extractErrorWindow.js

@@ -1,8 +1,8 @@
-var A=Object.defineProperty;var d=(t,n)=>A(t,"name",{value:n,configurable:!0});import{maskSensitiveOutput as S}from"../securityHelpers.js";import{DEPLOYMENT_FAILURE_LIMITS as C}from"./deploymentFailure.js";const N=[/❌/,/Resource handler returned message/i,/(?:CREATE|UPDATE|DELETE|IMPORT)_FAILED/,/ROLLBACK_(?:IN_PROGRESS|COMPLETE|FAILED)/],_=[/npm ERR!/,/error TS\d+/,/SyntaxError:/],T=[/Error occurred/i,/\berror:/i,/\bfailed:/i,/\bdenied\b/i,/\bexception\b/i],b=[...N,..._,...T],D=20,e="\u2026";function M(t,n){const r=Math.max(0,n);if(t.length<=r)return t;let c=r;const o=t.charCodeAt(c-1);return o>=55296&&o<=56319&&(c-=1),t.slice(0,c)}d(M,"truncateUtf16Safe");function w(t){const n=t.charCodeAt(0);return n>=56320&&n<=57343?t.slice(1):t}d(w,"trimLeadingLoneSurrogate");function P(t){return b.some(n=>n.test(t))}d(P,"isAnchorLine");function $(t,n={}){const r=n.maxLength??C.excerpt,c=n.contextLines??D,o=S(t);if(o.length<=r)return o;const s=o.split(`
-`),i=s.findIndex(P);if(i===-1)return e+w(o.slice(-(r-1)));const E=Math.min(s.length,i+c+1),h=s.slice(i,E).join(`
-`),L=i>0,I=E<s.length,a=r-(L?e.length+1:0)-e.length;if(h.length>a)return(L?`${e}
-`:"")+M(h,a)+e;const u=Math.max(0,i-c),g=I?`
-${e}`:"",x=[];let l=0;for(let f=i-1;f>=u;f--){const R=s[f]??"",O=l+R.length+1;if((f>0?e.length+1:0)+O+h.length+g.length>r)break;x.unshift(R),l=O}const m=i-x.length>0?`${e}
-`:"",p=x.length>0?`${x.join(`
+var S=Object.defineProperty;var h=(r,e)=>S(r,"name",{value:e,configurable:!0});import{maskSensitiveOutput as A}from"../securityHelpers.js";import{tailWithEllipsis as N,truncateUtf16Safe as _}from"../textBounds.js";import{DEPLOYMENT_FAILURE_LIMITS as T}from"./deploymentFailure.js";const C=[/❌/,/Resource handler returned message/i,/(?:CREATE|UPDATE|DELETE|IMPORT)_FAILED/,/ROLLBACK_(?:IN_PROGRESS|COMPLETE|FAILED)/],b=[/npm ERR!/,/error TS\d+/,/SyntaxError:/],D=[/Error occurred/i,/\berror:/i,/\bfailed:/i,/\bdenied\b/i,/\bexception\b/i],w=[...C,...b,...D],M=20,n="\u2026";function P(r){return w.some(e=>e.test(r))}h(P,"isAnchorLine");function B(r,e={}){const s=e.maxLength??T.excerpt,d=e.contextLines??M,c=A(r);if(c.length<=s)return c;const o=c.split(`
+`),t=o.findIndex(P);if(t===-1)return N(c,s);const l=Math.min(o.length,t+d+1),f=o.slice(t,l).join(`
+`),L=t>0,p=l<o.length,a=s-(L?n.length+1:0)-n.length;if(f.length>a)return(L?`${n}
+`:"")+_(f,a)+n;const I=Math.max(0,t-d),x=p?`
+${n}`:"",E=[];let R=0;for(let i=t-1;i>=I;i--){const g=o[i]??"",O=R+g.length+1;if((i>0?n.length+1:0)+O+f.length+x.length>s)break;E.unshift(g),R=O}const m=t-E.length>0?`${n}
+`:"",u=E.length>0?`${E.join(`
 `)}
-`:"";return m+p+h+g}d($,"extractErrorWindow");export{D as ERROR_WINDOW_CONTEXT_LINES,$ as extractErrorWindow};
+`:"";return m+u+f+x}h(B,"extractErrorWindow");export{M as ERROR_WINDOW_CONTEXT_LINES,B as extractErrorWindow};

package/dist/index.d.ts

@@ -4,19 +4,24 @@ export { type NonEmptyPartial } from "./nonEmptyPartial.js";
 export { APPROVAL_TOKEN_OUTPUT_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { HUNG_UPDATE_GRACE_MS, HUNG_UPDATE_REATTACH_BUDGET_MS } from "./deploy/hungUpdate.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
+export { ECS_TASK_REPLACEMENT_LIMITS } from "./infra/ecsTaskReplacement.js";
+export { describeUnparseableJson } from "./jsonParseRefusal.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
 export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
 export { APPLICATION_STACKS, type ApplicationStack, getApplicationStackName, isApplicationStack } from "./naming/applicationStackNames.js";
 export { stackScopedExportName, DEPLOYABLE_SERVICE_EXPORT_MARKER, DEPLOYABLE_CLUSTER_EXPORT_MARKER, CLUSTER_ARN_EXPORT_MARKER, VPC_CIDR_EXPORT_MARKER, deployableServiceExportName, legacyDeployableServiceExportName, isDeployableServiceExportName, deployableClusterExportName, clusterArnExportName, defaultVpcConstructId, vpcCidrExportName, legacyVpcCidrExportName, isVpcCidrExportName } from "./naming/stackExportNames.js";
 export { ec2ServiceName, mintedEc2KeyPairName } from "./naming/ec2Naming.js";
+export { CONNECTION_KEY_SUFFIX_SOURCE, connectionEnvSuffix, connectionKeyOrdinal } from "./naming/connectionKeySuffix.js";
 export { CAPACITY_SLOT_PATTERN, CAPACITY_SLOT_MAX_LENGTH, DEFAULT_CAPACITY_SLOT, CAPACITY_ANCHOR_PATTERN, CAPACITY_ANCHOR_MAX_LENGTH, CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityPinSchema, type CapacityIdentityPin, CapacityIdentityWireSchema, type CapacityIdentityWire, CapacityIdentityConfigSchema, type CapacityIdentityConfig, projectCapacityIdentityToTarget } from "./capacityIdentity.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
 export { compareCodeUnits } from "./codeUnitOrder.js";
+export { FJALL_NOTE_PREFIX, FJALL_WARNING_PREFIX, cdkDiagnosticLines } from "./cdkStreamNoise.js";
 export { defaultConnectedAccountName, suffixedAccountName, REGION_SHORT_CODES, findTrailingRegionShortCode, regionSuffixRejectionMessage } from "./naming/connectedAccountName.js";
 export { normaliseError, findOnCauseChain, getErrorMessage, hasErrorCode, getErrorCode, getErrorStack, formatErrorString } from "./errorUtils.js";
 export { FJALL_CONFIG_DIR_ENV, FJALL_CREDENTIALS_FILENAME, FJALL_HOME_DIRNAME, FJALL_LOG_DIR_ENV, fjallCredentialsPath, fjallHomeDir, fjallLogDir, fjallStatePath } from "./fjallHome.js";
 export { singleton } from "./async/singleton.js";
 export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSensitiveOutput, parseShellArgs, REDACTED_KEY_SENTINEL, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
+export { tailUtf16Safe, truncateUtf16Safe, truncateWithEllipsis } from "./textBounds.js";
 export { ARGV_ONLY_ENV_POLICY, buildChildEnv, CHILD_ENV_ALLOWED_NAMES, CHILD_ENV_NEVER_NAMES } from "./childEnvPolicy.js";
 export type { ChildEnvPolicy } from "./childEnvPolicy.js";
 export { sleep } from "./async/sleep.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as A,serialiseHostsChunks as t,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as C,BackupVaultLockSchema as O,BackupVaultVerdictSchema as i,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{HUNG_UPDATE_GRACE_MS as p,HUNG_UPDATE_REATTACH_BUDGET_MS as s}from"./deploy/hungUpdate.js";import{imageTagParameterName as D}from"./infra/imageTags.js";import{toPascalCase as U,toKebab as f,toValidDatabaseName as l,toScreamingSnake as u,capitalise as x,getSafeZoneName as F,accountConstructKey as d,hasAsciiStableConstructKey as G}from"./naming/caseConversion.js";import{albDnsExportName as V,albHostedZoneIdExportName as Y,cdnDomainExportName as H,bucketWebsiteEndpointExportName as K,bucketWebsiteHostedZoneIdExportName as h}from"./naming/targetExportNames.js";import{APPLICATION_STACKS as B,getApplicationStackName as v,isApplicationStack as X}from"./naming/applicationStackNames.js";import{stackScopedExportName as k,DEPLOYABLE_SERVICE_EXPORT_MARKER as W,DEPLOYABLE_CLUSTER_EXPORT_MARKER as J,CLUSTER_ARN_EXPORT_MARKER as j,VPC_CIDR_EXPORT_MARKER as w,deployableServiceExportName as Z,legacyDeployableServiceExportName as q,isDeployableServiceExportName as z,deployableClusterExportName as Q,clusterArnExportName as $,defaultVpcConstructId as EE,vpcCidrExportName as eE,legacyVpcCidrExportName as _E,isVpcCidrExportName as rE}from"./naming/stackExportNames.js";import{ec2ServiceName as SE,mintedEc2KeyPairName as AE}from"./naming/ec2Naming.js";import{CAPACITY_SLOT_PATTERN as oE,CAPACITY_SLOT_MAX_LENGTH as aE,DEFAULT_CAPACITY_SLOT as NE,CAPACITY_ANCHOR_PATTERN as RE,CAPACITY_ANCHOR_MAX_LENGTH as IE,CAPACITY_IDENTITY_CONTEXT_KEY as CE,CapacityIdentityPinSchema as OE,CapacityIdentityWireSchema as iE,CapacityIdentityConfigSchema as mE,projectCapacityIdentityToTarget as PE}from"./capacityIdentity.js";import{findAccountNameCollision as LE}from"./naming/accountNameCollision.js";import{compareCodeUnits as sE}from"./codeUnitOrder.js";import{defaultConnectedAccountName as DE,suffixedAccountName as ME,REGION_SHORT_CODES as UE,findTrailingRegionShortCode as fE,regionSuffixRejectionMessage as lE}from"./naming/connectedAccountName.js";import{normaliseError as xE,findOnCauseChain as FE,getErrorMessage as dE,hasErrorCode as GE,getErrorCode as gE,getErrorStack as VE,formatErrorString as YE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as KE,FJALL_CREDENTIALS_FILENAME as hE,FJALL_HOME_DIRNAME as yE,FJALL_LOG_DIR_ENV as BE,fjallCredentialsPath as vE,fjallHomeDir as XE,fjallLogDir as bE,fjallStatePath as kE}from"./fjallHome.js";import{singleton as JE}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as wE,filterDangerousEnvVars as ZE,MASKED_VALUE_MARKER as qE,maskSensitiveOutput as zE,parseShellArgs as QE,REDACTED_KEY_SENTINEL as $E,SCOPED_TOKEN_REGEX as Ee}from"./securityHelpers.js";import{ARGV_ONLY_ENV_POLICY as _e,buildChildEnv as re,CHILD_ENV_ALLOWED_NAMES as Te,CHILD_ENV_NEVER_NAMES as Se}from"./childEnvPolicy.js";import{sleep as te}from"./async/sleep.js";import{mapSettledWithConcurrency as ae}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Re,STRUCTURAL_ENVIRONMENTS as Ie,ACCOUNT_STAGES as Ce,ACCOUNT_STAGE_LABELS as Oe,isAccountStage as ie,ACCOUNT_TIERS as me,AccountTierSchema as Pe,isAccountTier as ne,GOVERNANCE_ACCOUNT_TIERS as Le,isGovernanceTier as pe,environmentToTier as se,accountStageEffect as ce,ACCOUNT_STAGE_EFFECTS as De,formatAccountStageList as Me,stageFromWireEnvironment as Ue,accountTier as fe,resolveSynthEnvironment as le,getEnvironmentLabel as ue,ACCOUNT_ROLES as xe}from"./environments.js";import{BACKUP_TIERS as de,BACKUP_TIER_DEFAULTS as Ge,BACKUP_TIER_TAG_KEY as ge,BACKUP_TIER_TAG_MAP as Ve,BackupTierSchema as Ye,isBackupTier as He,tierDefault as Ke}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as ye,isCodemodStatementType as Be}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as Xe,categoriseResource as be,getExpectedDuration as ke,getFriendlyResourceType as We}from"./resourceCategorisation.js";import{parseGitRemoteUrl as je}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Ze,AWS_REGIONS_METADATA as qe,DEFAULT_REGION as ze,getRegionInfo as Qe,MAX_SECONDARY_REGIONS as $e,OPT_IN_REGION_CODES as E_,optInRegionWarning as e_,regions as __,RETIRED_REGION_ABBREVIATIONS as r_,suggestRegionForTimezone as T_}from"./infra/regions.js";import{SCOPE_VALUES as A_,MACHINE_ONLY_SCOPES as t_,USER_GRANTABLE_SCOPES as o_,GOVERNANCE_SCOPE_REQUIRED_CODE as a_,SESSION_ONLY_API_ROUTES as N_}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as I_,SECRET_NAME_ERROR as C_,SSM_COMPONENT_PATTERN as O_,SSM_COMPONENT_ERROR as i_,SSM_STANDARD_MAX_VALUE_BYTES as m_,SecretNamespaceSchema as P_,buildNamespaceParts as n_,buildParameterPath as L_,parseParameterPath as p_,isManageablePath as s_,parseDotEnv as c_,escapeDotEnvValue as D_}from"./secrets.js";import{ConnectionWireSchema as U_,ConnectionsListResponseSchema as f_,CONNECTION_PHASES as l_,CONNECTION_TERMINAL_FAILURE_PHASES as u_,CONNECTION_FAILURE_REASONS as x_,EXTERNAL_ID_PATTERN as F_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as G_,isComplianceIssueStatus as g_,COMPLIANCE_ISSUE_SEVERITIES as V_}from"./complianceIssue.js";import{CI_PROVIDERS as H_,CI_SETUP_FIELDS as K_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as y_,CUSTOM_APP_TYPE as B_,APP_TYPES as v_}from"./appTypes.js";import{INSIGHT_TAB_VALUES as b_,INSIGHT_CATEGORIES as k_,INSIGHT_SEVERITIES as W_,INSIGHT_SORT_VALUES as J_}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as w_,INSTALL_SOURCES as Z_,SETUP_COMMANDS as q_,upgradeCommand as z_,SETUP_MODES as Q_,SETUP_STEP_IDS as $_,SETUP_STEPS as Er,AGENT_SETUP_PROMPTS as er,AGENT_INSTALL_COMMAND as _r,SKILL_INSTALL_SEGMENTS as rr,SKILL_INSTALL_FILENAME as Tr,SKILL_INSTALL_PATH as Sr}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as tr,deriveTargets as or,deriveAllTargets as ar,environmentOrTier as Nr,explainRetiredTargetName as Rr,findTarget as Ir,generateTargetName as Cr}from"./targets.js";import{buildAppConfigPath as ir}from"./repo/appPath.js";import{findInfrastructurePaths as Pr,findBoundaryPath as nr,isInfrastructureFile as Lr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as sr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Dr,RESERVED_APP_NAME_MESSAGE as Mr,isReservedAppName as Ur,RESERVED_APP_NAME_SUFFIX as fr,RESERVED_APP_NAME_SUFFIX_MESSAGE as lr,hasReservedAppNameSuffix as ur}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Fr,CONTENT_HASH_TAG_PATTERN as dr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as gr,DeployModeSchema as Vr,IMAGE_TAG_PATTERN as Yr,ImageTagSchema as Hr,ServiceArtefactSchema as Kr,ServiceArtefactsSchema as hr,ARTEFACT_OUTPUT_FIELDS as yr,artefactOutputKey as Br}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Xr,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as br,MIGRATION_SNAPSHOT_KIND_TAG_KEY as kr,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as Wr,EXPECTED_SCHEMA_VERSION_ENV as Jr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as jr,EXPECTED_CH_SCHEMA_VERSION_ENV as wr,SCHEMA_ADMIN_USER_ENV as Zr,SCHEMA_ADMIN_PASSWORD_ENV as qr,PRISMA_MIGRATION_DIR_RE as zr,CLICKHOUSE_MIGRATION_SKIP_RE as Qr}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as ET,SCHEMA_GATE_EXIT_HINTS as eT,schemaGateExitKind as _T}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as TT,FJALL_MAINTENANCE_USER as ST,FJALL_CLICKHOUSE_USERS as AT}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as oT}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as NT,PATTERN_TYPES as RT,isPatternType as IT,PATTERN_REGISTRY as CT,patternConstructId as OT,DEPLOYABLE_PATTERN_TYPES as iT,PATTERN_TIER_VALUES as mT,OPENNEXT_PATTERN_TYPES as PT,isOpenNextPatternType as nT,OPENNEXT_BUCKET_KEYS as LT,isOpenNextBucketKey as pT,patternBucketConstructId as sT,CLOUDFRONT_PRICE_CLASS_VALUES as cT,STATIC_SITE_CONFIG_KEYS as DT,STATIC_SITE_DEPLOY_INJECTED_KEYS as MT,STATIC_SITE_CDN_CONFIG_KEYS as UT,STATIC_SITE_ROUTING_VALUES as fT,STATIC_SITE_ROUTING_INFO as lT,PATTERN_CREATE_INPUT_VALUES as uT,PATTERN_CREATE_INPUT_FLAGS as xT}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as dT,FRAMEWORKS as GT,isFramework as gT,FRAMEWORK_PATTERN_RECOMMENDATIONS as VT,recommendPatternForFramework as YT,CREATABLE_FRAMEWORKS as HT,requiredInputsForFramework as KT}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as yT,defaultFormsFromAddress as BT,defaultFormsCorsOrigin as vT,isAddressAtDomain as XT}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as kT,DEV_SUBSTRATE_PARAMS_FILENAME as WT,DevSubstrateSynthPropsSchema as JT,DevSubstrateParamsSchema as jT}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as ZT}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as zT}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as $T,DeploymentFailurePhaseSchema as ES,DEPLOYMENT_FAULT_ATTRIBUTIONS as eS,DeploymentFaultAttributionSchema as _S,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as rS,DeploymentFailureProviderSourceSchema as TS,DEPLOYMENT_FAILURE_CODE_PATTERN as SS,DEPLOYMENT_FAILURE_SCHEMA_VERSION as AS,DEPLOYMENT_FAILURE_LIMITS as tS,DeploymentFailureAnalysisSchema as oS,DeploymentFailureProviderSchema as aS,DeploymentFailureResourceSchema as NS,DeploymentFailureSchema as RS,parseDeploymentFailure as IS,DEPLOYMENT_FAILURE_DOCS_BASE_URL as CS,deploymentFailureDocsUrl as OS,DEPLOYMENT_FAULT_COPY as iS,DEPLOYMENT_PROVIDER_LABELS as mS,deriveErrorMessageFromFailure as PS,toDeploymentFailureAnalysis as nS}from"./failure/deploymentFailure.js";import{extractErrorWindow as pS,ERROR_WINDOW_CONTEXT_LINES as sS}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as DS,FJALL_PROJECT_GITIGNORE as MS,FJALL_STATE_GITIGNORE_ENTRIES as US,FJALL_MANAGED_STATE_DIR_ENTRIES as fS,LOCAL_CONFIG_GITIGNORE_ENTRY as lS}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as xS}from"./scaffold/ensureGitignore.js";export{xe as ACCOUNT_ROLES,Ce as ACCOUNT_STAGES,Re as ACCOUNT_STAGES_WITH_ROOT,De as ACCOUNT_STAGE_EFFECTS,Oe as ACCOUNT_STAGE_LABELS,me as ACCOUNT_TIERS,_r as AGENT_INSTALL_COMMAND,er as AGENT_SETUP_PROMPTS,B as APPLICATION_STACKS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,v_ as APP_TYPES,_e as ARGV_ONLY_ENV_POLICY,yr as ARTEFACT_OUTPUT_FIELDS,qe as AWS_REGIONS_METADATA,Pe as AccountTierSchema,de as BACKUP_TIERS,Ge as BACKUP_TIER_DEFAULTS,ge as BACKUP_TIER_TAG_KEY,Ve as BACKUP_TIER_TAG_MAP,C as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,zT as BLESSED_CDK_TOOLCHAIN,Ye as BackupTierSchema,O as BackupVaultLockSchema,i as BackupVaultVerdictSchema,IE as CAPACITY_ANCHOR_MAX_LENGTH,RE as CAPACITY_ANCHOR_PATTERN,CE as CAPACITY_IDENTITY_CONTEXT_KEY,aE as CAPACITY_SLOT_MAX_LENGTH,oE as CAPACITY_SLOT_PATTERN,Te as CHILD_ENV_ALLOWED_NAMES,Se as CHILD_ENV_NEVER_NAMES,H_ as CI_PROVIDERS,K_ as CI_SETUP_FIELDS,Qr as CLICKHOUSE_MIGRATION_SKIP_RE,cT as CLOUDFRONT_PRICE_CLASS_VALUES,j as CLUSTER_ARN_EXPORT_MARKER,ye as CODEMOD_STATEMENT_TYPES,V_ as COMPLIANCE_ISSUE_SEVERITIES,G_ as COMPLIANCE_ISSUE_STATUSES,x_ as CONNECTION_FAILURE_REASONS,l_ as CONNECTION_PHASES,u_ as CONNECTION_TERMINAL_FAILURE_PHASES,dr as CONTENT_HASH_TAG_PATTERN,HT as CREATABLE_FRAMEWORKS,B_ as CUSTOM_APP_TYPE,mE as CapacityIdentityConfigSchema,OE as CapacityIdentityPinSchema,iE as CapacityIdentityWireSchema,U_ as ConnectionWireSchema,f_ as ConnectionsListResponseSchema,wE as DANGEROUS_ENV_VARS,NE as DEFAULT_CAPACITY_SLOT,yT as DEFAULT_FORMS_FROM_LOCAL_PART,ze as DEFAULT_REGION,J as DEPLOYABLE_CLUSTER_EXPORT_MARKER,iT as DEPLOYABLE_PATTERN_TYPES,W as DEPLOYABLE_SERVICE_EXPORT_MARKER,SS as DEPLOYMENT_FAILURE_CODE_PATTERN,CS as DEPLOYMENT_FAILURE_DOCS_BASE_URL,tS as DEPLOYMENT_FAILURE_LIMITS,$T as DEPLOYMENT_FAILURE_PHASES,rS as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,AS as DEPLOYMENT_FAILURE_SCHEMA_VERSION,eS as DEPLOYMENT_FAULT_ATTRIBUTIONS,iS as DEPLOYMENT_FAULT_COPY,mS as DEPLOYMENT_PROVIDER_LABELS,gr as DEPLOY_MODES,ZT as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,WT as DEV_SUBSTRATE_PARAMS_FILENAME,kT as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,Vr as DeployModeSchema,oS as DeploymentFailureAnalysisSchema,ES as DeploymentFailurePhaseSchema,aS as DeploymentFailureProviderSchema,TS as DeploymentFailureProviderSourceSchema,NS as DeploymentFailureResourceSchema,RS as DeploymentFailureSchema,_S as DeploymentFaultAttributionSchema,jT as DevSubstrateParamsSchema,JT as DevSubstrateSynthPropsSchema,sS as ERROR_WINDOW_CONTEXT_LINES,wr as EXPECTED_CH_SCHEMA_VERSION_ENV,Jr as EXPECTED_SCHEMA_VERSION_ENV,jr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,F_ as EXTERNAL_ID_PATTERN,AT as FJALL_CLICKHOUSE_USERS,DS as FJALL_COMPONENT_GITIGNORE,KE as FJALL_CONFIG_DIR_ENV,hE as FJALL_CREDENTIALS_FILENAME,yE as FJALL_HOME_DIRNAME,BE as FJALL_LOG_DIR_ENV,ST as FJALL_MAINTENANCE_USER,fS as FJALL_MANAGED_STATE_DIR_ENTRIES,MS as FJALL_PROJECT_GITIGNORE,TT as FJALL_SCHEMA_GATE_USER,US as FJALL_STATE_GITIGNORE_ENTRIES,GT as FRAMEWORKS,VT as FRAMEWORK_PATTERN_RECOMMENDATIONS,dT as FRAMEWORK_VALUES,Le as GOVERNANCE_ACCOUNT_TIERS,a_ as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,p as HUNG_UPDATE_GRACE_MS,s as HUNG_UPDATE_REATTACH_BUDGET_MS,Yr as IMAGE_TAG_PATTERN,y_ as INFRASTRUCTURE_TIER_NAMES,k_ as INSIGHT_CATEGORIES,W_ as INSIGHT_SEVERITIES,J_ as INSIGHT_SORT_VALUES,b_ as INSIGHT_TAB_VALUES,Z_ as INSTALL_SOURCES,Hr as ImageTagSchema,lS as LOCAL_CONFIG_GITIGNORE_ENTRY,t_ as MACHINE_ONLY_SCOPES,qE as MASKED_VALUE_MARKER,$e as MAX_SECONDARY_REGIONS,Wr as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,kr as MIGRATION_SNAPSHOT_KIND_TAG_KEY,Xr as MIGRATION_SNAPSHOT_NAME_PREFIX,br as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,LT as OPENNEXT_BUCKET_KEYS,PT as OPENNEXT_PATTERN_TYPES,E_ as OPT_IN_REGION_CODES,xT as PATTERN_CREATE_INPUT_FLAGS,uT as PATTERN_CREATE_INPUT_VALUES,CT as PATTERN_REGISTRY,mT as PATTERN_TIER_VALUES,RT as PATTERN_TYPES,NT as PATTERN_TYPE_VALUES,oT as PHYSICAL_NAME_FALLBACK_PROPERTIES,zr as PRISMA_MIGRATION_DIR_RE,w_ as PUBLIC_PACKAGE_NAME,$E as REDACTED_KEY_SENTINEL,UE as REGION_SHORT_CODES,Dr as RESERVED_APP_NAMES,Mr as RESERVED_APP_NAME_MESSAGE,fr as RESERVED_APP_NAME_SUFFIX,lr as RESERVED_APP_NAME_SUFFIX_MESSAGE,Xe as RESOURCE_CATEGORIES,r_ as RETIRED_REGION_ABBREVIATIONS,qr as SCHEMA_ADMIN_PASSWORD_ENV,Zr as SCHEMA_ADMIN_USER_ENV,ET as SCHEMA_GATE_EXIT,eT as SCHEMA_GATE_EXIT_HINTS,Ee as SCOPED_TOKEN_REGEX,A_ as SCOPE_VALUES,C_ as SECRET_NAME_ERROR,I_ as SECRET_NAME_PATTERN,N_ as SESSION_ONLY_API_ROUTES,q_ as SETUP_COMMANDS,Q_ as SETUP_MODES,Er as SETUP_STEPS,$_ as SETUP_STEP_IDS,Tr as SKILL_INSTALL_FILENAME,Sr as SKILL_INSTALL_PATH,rr as SKILL_INSTALL_SEGMENTS,i_ as SSM_COMPONENT_ERROR,O_ as SSM_COMPONENT_PATTERN,m_ as SSM_STANDARD_MAX_VALUE_BYTES,UT as STATIC_SITE_CDN_CONFIG_KEYS,DT as STATIC_SITE_CONFIG_KEYS,MT as STATIC_SITE_DEPLOY_INJECTED_KEYS,lT as STATIC_SITE_ROUTING_INFO,fT as STATIC_SITE_ROUTING_VALUES,Ie as STRUCTURAL_ENVIRONMENTS,P_ as SecretNamespaceSchema,Kr as ServiceArtefactSchema,hr as ServiceArtefactsSchema,o_ as USER_GRANTABLE_SCOPES,w as VPC_CIDR_EXPORT_MARKER,Ze as abbreviateRegion,d as accountConstructKey,ce as accountStageEffect,fe as accountTier,V as albDnsExportName,Y as albHostedZoneIdExportName,Br as artefactOutputKey,K as bucketWebsiteEndpointExportName,h as bucketWebsiteHostedZoneIdExportName,ir as buildAppConfigPath,re as buildChildEnv,n_ as buildNamespaceParts,L_ as buildParameterPath,x as capitalise,be as categoriseResource,H as cdnDomainExportName,$ as clusterArnExportName,sE as compareCodeUnits,DE as defaultConnectedAccountName,vT as defaultFormsCorsOrigin,BT as defaultFormsFromAddress,EE as defaultVpcConstructId,Q as deployableClusterExportName,Z as deployableServiceExportName,OS as deploymentFailureDocsUrl,ar as deriveAllTargets,Fr as deriveContentHashTag,PS as deriveErrorMessageFromFailure,tr as deriveRegionsFromOrgConfig,or as deriveTargets,SE as ec2ServiceName,xS as ensureGitignoreEntries,Nr as environmentOrTier,se as environmentToTier,D_ as escapeDotEnvValue,Rr as explainRetiredTargetName,pS as extractErrorWindow,ZE as filterDangerousEnvVars,LE as findAccountNameCollision,nr as findBoundaryPath,Pr as findInfrastructurePaths,FE as findOnCauseChain,Ir as findTarget,fE as findTrailingRegionShortCode,vE as fjallCredentialsPath,XE as fjallHomeDir,bE as fjallLogDir,kE as fjallStatePath,Me as formatAccountStageList,YE as formatErrorString,Cr as generateTargetName,v as getApplicationStackName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,ue as getEnvironmentLabel,gE as getErrorCode,dE as getErrorMessage,VE as getErrorStack,ke as getExpectedDuration,We as getFriendlyResourceType,Qe as getRegionInfo,F as getSafeZoneName,G as hasAsciiStableConstructKey,GE as hasErrorCode,ur as hasReservedAppNameSuffix,A as hostsExportPartName,D as imageTagParameterName,sr as inferContainerFromCandidates,ie as isAccountStage,ne as isAccountTier,XT as isAddressAtDomain,X as isApplicationStack,He as isBackupTier,Be as isCodemodStatementType,g_ as isComplianceIssueStatus,z as isDeployableServiceExportName,gT as isFramework,pe as isGovernanceTier,Lr as isInfrastructureFile,s_ as isManageablePath,a as isManagedDomainBinding,pT as isOpenNextBucketKey,nT as isOpenNextPatternType,IT as isPatternType,m as isReownedBackupVault,Ur as isReservedAppName,rE as isVpcCidrExportName,q as legacyDeployableServiceExportName,_E as legacyVpcCidrExportName,ae as mapSettledWithConcurrency,zE as maskSensitiveOutput,AE as mintedEc2KeyPairName,xE as normaliseError,e_ as optInRegionWarning,IS as parseDeploymentFailure,c_ as parseDotEnv,je as parseGitRemoteUrl,p_ as parseParameterPath,QE as parseShellArgs,sT as patternBucketConstructId,OT as patternConstructId,PE as projectCapacityIdentityToTarget,YT as recommendPatternForFramework,lE as regionSuffixRejectionMessage,__ as regions,KT as requiredInputsForFramework,le as resolveSynthEnvironment,_T as schemaGateExitKind,t as serialiseHostsChunks,JE as singleton,te as sleep,k as stackScopedExportName,Ue as stageFromWireEnvironment,ME as suffixedAccountName,T_ as suggestRegionForTimezone,Ke as tierDefault,nS as toDeploymentFailureAnalysis,f as toKebab,U as toPascalCase,u as toScreamingSnake,l as toValidDatabaseName,z_ as upgradeCommand,eE as vpcCidrExportName};
+import{DNS_APEX as _,getDomainExportNames as r,getDomainStackName as T,getDomainUsEast1CertificatesStackName as S,hostsExportPartName as t,serialiseHostsChunks as A,HOSTS_OUTPUT_MAX_BYTES as o,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as N}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as I,BACKUP_VAULT_CONTEXT_KEY as C,BackupVaultLockSchema as i,BackupVaultVerdictSchema as O,isReownedBackupVault as m}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as P}from"./deploy/approvalTokenOutput.js";import{HUNG_UPDATE_GRACE_MS as p,HUNG_UPDATE_REATTACH_BUDGET_MS as s}from"./deploy/hungUpdate.js";import{imageTagParameterName as D}from"./infra/imageTags.js";import{ECS_TASK_REPLACEMENT_LIMITS as f}from"./infra/ecsTaskReplacement.js";import{describeUnparseableJson as l}from"./jsonParseRefusal.js";import{toPascalCase as F,toKebab as u,toValidDatabaseName as d,toScreamingSnake as G,capitalise as g,getSafeZoneName as V,accountConstructKey as Y,hasAsciiStableConstructKey as H}from"./naming/caseConversion.js";import{albDnsExportName as h,albHostedZoneIdExportName as y,cdnDomainExportName as B,bucketWebsiteEndpointExportName as v,bucketWebsiteHostedZoneIdExportName as X}from"./naming/targetExportNames.js";import{APPLICATION_STACKS as k,getApplicationStackName as W,isApplicationStack as J}from"./naming/applicationStackNames.js";import{stackScopedExportName as w,DEPLOYABLE_SERVICE_EXPORT_MARKER as Z,DEPLOYABLE_CLUSTER_EXPORT_MARKER as q,CLUSTER_ARN_EXPORT_MARKER as z,VPC_CIDR_EXPORT_MARKER as Q,deployableServiceExportName as $,legacyDeployableServiceExportName as EE,isDeployableServiceExportName as eE,deployableClusterExportName as _E,clusterArnExportName as rE,defaultVpcConstructId as TE,vpcCidrExportName as SE,legacyVpcCidrExportName as tE,isVpcCidrExportName as AE}from"./naming/stackExportNames.js";import{ec2ServiceName as aE,mintedEc2KeyPairName as NE}from"./naming/ec2Naming.js";import{CONNECTION_KEY_SUFFIX_SOURCE as IE,connectionEnvSuffix as CE,connectionKeyOrdinal as iE}from"./naming/connectionKeySuffix.js";import{CAPACITY_SLOT_PATTERN as mE,CAPACITY_SLOT_MAX_LENGTH as nE,DEFAULT_CAPACITY_SLOT as PE,CAPACITY_ANCHOR_PATTERN as LE,CAPACITY_ANCHOR_MAX_LENGTH as pE,CAPACITY_IDENTITY_CONTEXT_KEY as sE,CapacityIdentityPinSchema as cE,CapacityIdentityWireSchema as DE,CapacityIdentityConfigSchema as ME,projectCapacityIdentityToTarget as fE}from"./capacityIdentity.js";import{findAccountNameCollision as lE}from"./naming/accountNameCollision.js";import{compareCodeUnits as FE}from"./codeUnitOrder.js";import{FJALL_NOTE_PREFIX as dE,FJALL_WARNING_PREFIX as GE,cdkDiagnosticLines as gE}from"./cdkStreamNoise.js";import{defaultConnectedAccountName as YE,suffixedAccountName as HE,REGION_SHORT_CODES as KE,findTrailingRegionShortCode as hE,regionSuffixRejectionMessage as yE}from"./naming/connectedAccountName.js";import{normaliseError as vE,findOnCauseChain as XE,getErrorMessage as bE,hasErrorCode as kE,getErrorCode as WE,getErrorStack as JE,formatErrorString as jE}from"./errorUtils.js";import{FJALL_CONFIG_DIR_ENV as ZE,FJALL_CREDENTIALS_FILENAME as qE,FJALL_HOME_DIRNAME as zE,FJALL_LOG_DIR_ENV as QE,fjallCredentialsPath as $E,fjallHomeDir as Ee,fjallLogDir as ee,fjallStatePath as _e}from"./fjallHome.js";import{singleton as Te}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as te,filterDangerousEnvVars as Ae,MASKED_VALUE_MARKER as oe,maskSensitiveOutput as ae,parseShellArgs as Ne,REDACTED_KEY_SENTINEL as Re,SCOPED_TOKEN_REGEX as Ie}from"./securityHelpers.js";import{tailUtf16Safe as ie,truncateUtf16Safe as Oe,truncateWithEllipsis as me}from"./textBounds.js";import{ARGV_ONLY_ENV_POLICY as Pe,buildChildEnv as Le,CHILD_ENV_ALLOWED_NAMES as pe,CHILD_ENV_NEVER_NAMES as se}from"./childEnvPolicy.js";import{sleep as De}from"./async/sleep.js";import{mapSettledWithConcurrency as fe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as le,STRUCTURAL_ENVIRONMENTS as xe,ACCOUNT_STAGES as Fe,ACCOUNT_STAGE_LABELS as ue,isAccountStage as de,ACCOUNT_TIERS as Ge,AccountTierSchema as ge,isAccountTier as Ve,GOVERNANCE_ACCOUNT_TIERS as Ye,isGovernanceTier as He,environmentToTier as Ke,accountStageEffect as he,ACCOUNT_STAGE_EFFECTS as ye,formatAccountStageList as Be,stageFromWireEnvironment as ve,accountTier as Xe,resolveSynthEnvironment as be,getEnvironmentLabel as ke,ACCOUNT_ROLES as We}from"./environments.js";import{BACKUP_TIERS as je,BACKUP_TIER_DEFAULTS as we,BACKUP_TIER_TAG_KEY as Ze,BACKUP_TIER_TAG_MAP as qe,BackupTierSchema as ze,isBackupTier as Qe,tierDefault as $e}from"./backupTiers.js";import{CODEMOD_STATEMENT_TYPES as e_,isCodemodStatementType as __}from"./codemod/statementTypes.js";import{RESOURCE_CATEGORIES as T_,categoriseResource as S_,getExpectedDuration as t_,getFriendlyResourceType as A_}from"./resourceCategorisation.js";import{parseGitRemoteUrl as a_}from"./repo/gitRemoteParser.js";import{abbreviateRegion as R_,AWS_REGIONS_METADATA as I_,DEFAULT_REGION as C_,getRegionInfo as i_,MAX_SECONDARY_REGIONS as O_,OPT_IN_REGION_CODES as m_,optInRegionWarning as n_,regions as P_,RETIRED_REGION_ABBREVIATIONS as L_,suggestRegionForTimezone as p_}from"./infra/regions.js";import{SCOPE_VALUES as c_,MACHINE_ONLY_SCOPES as D_,USER_GRANTABLE_SCOPES as M_,GOVERNANCE_SCOPE_REQUIRED_CODE as f_,SESSION_ONLY_API_ROUTES as U_}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as x_,SECRET_NAME_ERROR as F_,SSM_COMPONENT_PATTERN as u_,SSM_COMPONENT_ERROR as d_,SSM_STANDARD_MAX_VALUE_BYTES as G_,SecretNamespaceSchema as g_,buildNamespaceParts as V_,buildParameterPath as Y_,parseParameterPath as H_,isManageablePath as K_,parseDotEnv as h_,escapeDotEnvValue as y_}from"./secrets.js";import{ConnectionWireSchema as v_,ConnectionsListResponseSchema as X_,CONNECTION_PHASES as b_,CONNECTION_TERMINAL_FAILURE_PHASES as k_,CONNECTION_FAILURE_REASONS as W_,EXTERNAL_ID_PATTERN as J_}from"./infra/connectionsWire.js";import{COMPLIANCE_ISSUE_STATUSES as w_,isComplianceIssueStatus as Z_,COMPLIANCE_ISSUE_SEVERITIES as q_}from"./complianceIssue.js";import{CI_PROVIDERS as Q_,CI_SETUP_FIELDS as $_}from"./ciSetup.js";import{INFRASTRUCTURE_TIER_NAMES as er,CUSTOM_APP_TYPE as _r,APP_TYPES as rr}from"./appTypes.js";import{INSIGHT_TAB_VALUES as Sr,INSIGHT_CATEGORIES as tr,INSIGHT_SEVERITIES as Ar,INSIGHT_SORT_VALUES as or}from"./insights/vocabulary.js";import{PUBLIC_PACKAGE_NAME as Nr,INSTALL_SOURCES as Rr,SETUP_COMMANDS as Ir,upgradeCommand as Cr,SETUP_MODES as ir,SETUP_STEP_IDS as Or,SETUP_STEPS as mr,AGENT_SETUP_PROMPTS as nr,AGENT_INSTALL_COMMAND as Pr,SKILL_INSTALL_SEGMENTS as Lr,SKILL_INSTALL_FILENAME as pr,SKILL_INSTALL_PATH as sr}from"./onboarding/index.js";import{deriveRegionsFromOrgConfig as Dr,deriveTargets as Mr,deriveAllTargets as fr,environmentOrTier as Ur,explainRetiredTargetName as lr,findTarget as xr,generateTargetName as Fr}from"./targets.js";import{buildAppConfigPath as dr}from"./repo/appPath.js";import{findInfrastructurePaths as gr,findBoundaryPath as Vr,isInfrastructureFile as Yr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as Kr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as yr,RESERVED_APP_NAME_MESSAGE as Br,isReservedAppName as vr,RESERVED_APP_NAME_SUFFIX as Xr,RESERVED_APP_NAME_SUFFIX_MESSAGE as br,hasReservedAppNameSuffix as kr}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Jr,CONTENT_HASH_TAG_PATTERN as jr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as Zr,DeployModeSchema as qr,IMAGE_TAG_PATTERN as zr,ImageTagSchema as Qr,ServiceArtefactSchema as $r,ServiceArtefactsSchema as ET,ARTEFACT_OUTPUT_FIELDS as eT,artefactOutputKey as _T}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as TT,MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV as ST,MIGRATION_SNAPSHOT_KIND_TAG_KEY as tT,MIGRATION_SNAPSHOT_KIND_PREMIGRATE as AT,EXPECTED_SCHEMA_VERSION_ENV as oT,EXPECTED_SCHEMA_VERSION_TOOL_ENV as aT,EXPECTED_CH_SCHEMA_VERSION_ENV as NT,SCHEMA_ADMIN_USER_ENV as RT,SCHEMA_ADMIN_PASSWORD_ENV as IT,PRISMA_MIGRATION_DIR_RE as CT,CLICKHOUSE_MIGRATION_SKIP_RE as iT}from"./migration/constants.js";import{SCHEMA_GATE_EXIT as mT,SCHEMA_GATE_EXIT_HINTS as nT,schemaGateExitKind as PT}from"./migration/schemaGateExit.js";import{FJALL_SCHEMA_GATE_USER as pT,FJALL_MAINTENANCE_USER as sT,FJALL_CLICKHOUSE_USERS as cT}from"./migration/clickhouseFrameworkUsers.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as MT}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as UT,PATTERN_TYPES as lT,isPatternType as xT,PATTERN_REGISTRY as FT,patternConstructId as uT,DEPLOYABLE_PATTERN_TYPES as dT,PATTERN_TIER_VALUES as GT,OPENNEXT_PATTERN_TYPES as gT,isOpenNextPatternType as VT,OPENNEXT_BUCKET_KEYS as YT,isOpenNextBucketKey as HT,patternBucketConstructId as KT,CLOUDFRONT_PRICE_CLASS_VALUES as hT,STATIC_SITE_CONFIG_KEYS as yT,STATIC_SITE_DEPLOY_INJECTED_KEYS as BT,STATIC_SITE_CDN_CONFIG_KEYS as vT,STATIC_SITE_ROUTING_VALUES as XT,STATIC_SITE_ROUTING_INFO as bT,PATTERN_CREATE_INPUT_VALUES as kT,PATTERN_CREATE_INPUT_FLAGS as WT}from"./patterns/patternTypes.js";import{FRAMEWORK_VALUES as jT,FRAMEWORKS as wT,isFramework as ZT,FRAMEWORK_PATTERN_RECOMMENDATIONS as qT,recommendPatternForFramework as zT,CREATABLE_FRAMEWORKS as QT,requiredInputsForFramework as $T}from"./patterns/frameworkPatterns.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as eS,defaultFormsFromAddress as _S,defaultFormsCorsOrigin as rS,isAddressAtDomain as TS}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as tS,DEV_SUBSTRATE_PARAMS_FILENAME as AS,DevSubstrateSynthPropsSchema as oS,DevSubstrateParamsSchema as aS}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as RS}from"./devSubstrate/entrypoint.js";import{BLESSED_CDK_TOOLCHAIN as CS}from"./cdkToolchain.js";import{DEPLOYMENT_FAILURE_PHASES as OS,DeploymentFailurePhaseSchema as mS,DEPLOYMENT_FAULT_ATTRIBUTIONS as nS,DeploymentFaultAttributionSchema as PS,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as LS,DeploymentFailureProviderSourceSchema as pS,DEPLOYMENT_FAILURE_CODE_PATTERN as sS,DEPLOYMENT_FAILURE_SCHEMA_VERSION as cS,DEPLOYMENT_FAILURE_LIMITS as DS,DeploymentFailureAnalysisSchema as MS,DeploymentFailureProviderSchema as fS,DeploymentFailureResourceSchema as US,DeploymentFailureSchema as lS,parseDeploymentFailure as xS,DEPLOYMENT_FAILURE_DOCS_BASE_URL as FS,deploymentFailureDocsUrl as uS,DEPLOYMENT_FAULT_COPY as dS,DEPLOYMENT_PROVIDER_LABELS as GS,deriveErrorMessageFromFailure as gS,toDeploymentFailureAnalysis as VS}from"./failure/deploymentFailure.js";import{extractErrorWindow as HS,ERROR_WINDOW_CONTEXT_LINES as KS}from"./failure/extractErrorWindow.js";import{FJALL_COMPONENT_GITIGNORE as yS,FJALL_PROJECT_GITIGNORE as BS,FJALL_STATE_GITIGNORE_ENTRIES as vS,FJALL_MANAGED_STATE_DIR_ENTRIES as XS,LOCAL_CONFIG_GITIGNORE_ENTRY as bS}from"./scaffold/gitignore.js";import{ensureGitignoreEntries as WS}from"./scaffold/ensureGitignore.js";export{We as ACCOUNT_ROLES,Fe as ACCOUNT_STAGES,le as ACCOUNT_STAGES_WITH_ROOT,ye as ACCOUNT_STAGE_EFFECTS,ue as ACCOUNT_STAGE_LABELS,Ge as ACCOUNT_TIERS,Pr as AGENT_INSTALL_COMMAND,nr as AGENT_SETUP_PROMPTS,k as APPLICATION_STACKS,P as APPROVAL_TOKEN_OUTPUT_PREFIX,rr as APP_TYPES,Pe as ARGV_ONLY_ENV_POLICY,eT as ARTEFACT_OUTPUT_FIELDS,I_ as AWS_REGIONS_METADATA,ge as AccountTierSchema,je as BACKUP_TIERS,we as BACKUP_TIER_DEFAULTS,Ze as BACKUP_TIER_TAG_KEY,qe as BACKUP_TIER_TAG_MAP,C as BACKUP_VAULT_CONTEXT_KEY,I as BACKUP_VAULT_NAME,CS as BLESSED_CDK_TOOLCHAIN,ze as BackupTierSchema,i as BackupVaultLockSchema,O as BackupVaultVerdictSchema,pE as CAPACITY_ANCHOR_MAX_LENGTH,LE as CAPACITY_ANCHOR_PATTERN,sE as CAPACITY_IDENTITY_CONTEXT_KEY,nE as CAPACITY_SLOT_MAX_LENGTH,mE as CAPACITY_SLOT_PATTERN,pe as CHILD_ENV_ALLOWED_NAMES,se as CHILD_ENV_NEVER_NAMES,Q_ as CI_PROVIDERS,$_ as CI_SETUP_FIELDS,iT as CLICKHOUSE_MIGRATION_SKIP_RE,hT as CLOUDFRONT_PRICE_CLASS_VALUES,z as CLUSTER_ARN_EXPORT_MARKER,e_ as CODEMOD_STATEMENT_TYPES,q_ as COMPLIANCE_ISSUE_SEVERITIES,w_ as COMPLIANCE_ISSUE_STATUSES,W_ as CONNECTION_FAILURE_REASONS,IE as CONNECTION_KEY_SUFFIX_SOURCE,b_ as CONNECTION_PHASES,k_ as CONNECTION_TERMINAL_FAILURE_PHASES,jr as CONTENT_HASH_TAG_PATTERN,QT as CREATABLE_FRAMEWORKS,_r as CUSTOM_APP_TYPE,ME as CapacityIdentityConfigSchema,cE as CapacityIdentityPinSchema,DE as CapacityIdentityWireSchema,v_ as ConnectionWireSchema,X_ as ConnectionsListResponseSchema,te as DANGEROUS_ENV_VARS,PE as DEFAULT_CAPACITY_SLOT,eS as DEFAULT_FORMS_FROM_LOCAL_PART,C_ as DEFAULT_REGION,q as DEPLOYABLE_CLUSTER_EXPORT_MARKER,dT as DEPLOYABLE_PATTERN_TYPES,Z as DEPLOYABLE_SERVICE_EXPORT_MARKER,sS as DEPLOYMENT_FAILURE_CODE_PATTERN,FS as DEPLOYMENT_FAILURE_DOCS_BASE_URL,DS as DEPLOYMENT_FAILURE_LIMITS,OS as DEPLOYMENT_FAILURE_PHASES,LS as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,cS as DEPLOYMENT_FAILURE_SCHEMA_VERSION,nS as DEPLOYMENT_FAULT_ATTRIBUTIONS,dS as DEPLOYMENT_FAULT_COPY,GS as DEPLOYMENT_PROVIDER_LABELS,Zr as DEPLOY_MODES,RS as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,AS as DEV_SUBSTRATE_PARAMS_FILENAME,tS as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,_ as DNS_APEX,N as DOMAIN_DEPLOY_DEFAULT_PHASE,qr as DeployModeSchema,MS as DeploymentFailureAnalysisSchema,mS as DeploymentFailurePhaseSchema,fS as DeploymentFailureProviderSchema,pS as DeploymentFailureProviderSourceSchema,US as DeploymentFailureResourceSchema,lS as DeploymentFailureSchema,PS as DeploymentFaultAttributionSchema,aS as DevSubstrateParamsSchema,oS as DevSubstrateSynthPropsSchema,f as ECS_TASK_REPLACEMENT_LIMITS,KS as ERROR_WINDOW_CONTEXT_LINES,NT as EXPECTED_CH_SCHEMA_VERSION_ENV,oT as EXPECTED_SCHEMA_VERSION_ENV,aT as EXPECTED_SCHEMA_VERSION_TOOL_ENV,J_ as EXTERNAL_ID_PATTERN,cT as FJALL_CLICKHOUSE_USERS,yS as FJALL_COMPONENT_GITIGNORE,ZE as FJALL_CONFIG_DIR_ENV,qE as FJALL_CREDENTIALS_FILENAME,zE as FJALL_HOME_DIRNAME,QE as FJALL_LOG_DIR_ENV,sT as FJALL_MAINTENANCE_USER,XS as FJALL_MANAGED_STATE_DIR_ENTRIES,dE as FJALL_NOTE_PREFIX,BS as FJALL_PROJECT_GITIGNORE,pT as FJALL_SCHEMA_GATE_USER,vS as FJALL_STATE_GITIGNORE_ENTRIES,GE as FJALL_WARNING_PREFIX,wT as FRAMEWORKS,qT as FRAMEWORK_PATTERN_RECOMMENDATIONS,jT as FRAMEWORK_VALUES,Ye as GOVERNANCE_ACCOUNT_TIERS,f_ as GOVERNANCE_SCOPE_REQUIRED_CODE,o as HOSTS_OUTPUT_MAX_BYTES,p as HUNG_UPDATE_GRACE_MS,s as HUNG_UPDATE_REATTACH_BUDGET_MS,zr as IMAGE_TAG_PATTERN,er as INFRASTRUCTURE_TIER_NAMES,tr as INSIGHT_CATEGORIES,Ar as INSIGHT_SEVERITIES,or as INSIGHT_SORT_VALUES,Sr as INSIGHT_TAB_VALUES,Rr as INSTALL_SOURCES,Qr as ImageTagSchema,bS as LOCAL_CONFIG_GITIGNORE_ENTRY,D_ as MACHINE_ONLY_SCOPES,oe as MASKED_VALUE_MARKER,O_ as MAX_SECONDARY_REGIONS,AT as MIGRATION_SNAPSHOT_KIND_PREMIGRATE,tT as MIGRATION_SNAPSHOT_KIND_TAG_KEY,TT as MIGRATION_SNAPSHOT_NAME_PREFIX,ST as MIGRATION_SNAPSHOT_RETENTION_DAYS_ENV,YT as OPENNEXT_BUCKET_KEYS,gT as OPENNEXT_PATTERN_TYPES,m_ as OPT_IN_REGION_CODES,WT as PATTERN_CREATE_INPUT_FLAGS,kT as PATTERN_CREATE_INPUT_VALUES,FT as PATTERN_REGISTRY,GT as PATTERN_TIER_VALUES,lT as PATTERN_TYPES,UT as PATTERN_TYPE_VALUES,MT as PHYSICAL_NAME_FALLBACK_PROPERTIES,CT as PRISMA_MIGRATION_DIR_RE,Nr as PUBLIC_PACKAGE_NAME,Re as REDACTED_KEY_SENTINEL,KE as REGION_SHORT_CODES,yr as RESERVED_APP_NAMES,Br as RESERVED_APP_NAME_MESSAGE,Xr as RESERVED_APP_NAME_SUFFIX,br as RESERVED_APP_NAME_SUFFIX_MESSAGE,T_ as RESOURCE_CATEGORIES,L_ as RETIRED_REGION_ABBREVIATIONS,IT as SCHEMA_ADMIN_PASSWORD_ENV,RT as SCHEMA_ADMIN_USER_ENV,mT as SCHEMA_GATE_EXIT,nT as SCHEMA_GATE_EXIT_HINTS,Ie as SCOPED_TOKEN_REGEX,c_ as SCOPE_VALUES,F_ as SECRET_NAME_ERROR,x_ as SECRET_NAME_PATTERN,U_ as SESSION_ONLY_API_ROUTES,Ir as SETUP_COMMANDS,ir as SETUP_MODES,mr as SETUP_STEPS,Or as SETUP_STEP_IDS,pr as SKILL_INSTALL_FILENAME,sr as SKILL_INSTALL_PATH,Lr as SKILL_INSTALL_SEGMENTS,d_ as SSM_COMPONENT_ERROR,u_ as SSM_COMPONENT_PATTERN,G_ as SSM_STANDARD_MAX_VALUE_BYTES,vT as STATIC_SITE_CDN_CONFIG_KEYS,yT as STATIC_SITE_CONFIG_KEYS,BT as STATIC_SITE_DEPLOY_INJECTED_KEYS,bT as STATIC_SITE_ROUTING_INFO,XT as STATIC_SITE_ROUTING_VALUES,xe as STRUCTURAL_ENVIRONMENTS,g_ as SecretNamespaceSchema,$r as ServiceArtefactSchema,ET as ServiceArtefactsSchema,M_ as USER_GRANTABLE_SCOPES,Q as VPC_CIDR_EXPORT_MARKER,R_ as abbreviateRegion,Y as accountConstructKey,he as accountStageEffect,Xe as accountTier,h as albDnsExportName,y as albHostedZoneIdExportName,_T as artefactOutputKey,v as bucketWebsiteEndpointExportName,X as bucketWebsiteHostedZoneIdExportName,dr as buildAppConfigPath,Le as buildChildEnv,V_ as buildNamespaceParts,Y_ as buildParameterPath,g as capitalise,S_ as categoriseResource,gE as cdkDiagnosticLines,B as cdnDomainExportName,rE as clusterArnExportName,FE as compareCodeUnits,CE as connectionEnvSuffix,iE as connectionKeyOrdinal,YE as defaultConnectedAccountName,rS as defaultFormsCorsOrigin,_S as defaultFormsFromAddress,TE as defaultVpcConstructId,_E as deployableClusterExportName,$ as deployableServiceExportName,uS as deploymentFailureDocsUrl,fr as deriveAllTargets,Jr as deriveContentHashTag,gS as deriveErrorMessageFromFailure,Dr as deriveRegionsFromOrgConfig,Mr as deriveTargets,l as describeUnparseableJson,aE as ec2ServiceName,WS as ensureGitignoreEntries,Ur as environmentOrTier,Ke as environmentToTier,y_ as escapeDotEnvValue,lr as explainRetiredTargetName,HS as extractErrorWindow,Ae as filterDangerousEnvVars,lE as findAccountNameCollision,Vr as findBoundaryPath,gr as findInfrastructurePaths,XE as findOnCauseChain,xr as findTarget,hE as findTrailingRegionShortCode,$E as fjallCredentialsPath,Ee as fjallHomeDir,ee as fjallLogDir,_e as fjallStatePath,Be as formatAccountStageList,jE as formatErrorString,Fr as generateTargetName,W as getApplicationStackName,r as getDomainExportNames,T as getDomainStackName,S as getDomainUsEast1CertificatesStackName,ke as getEnvironmentLabel,WE as getErrorCode,bE as getErrorMessage,JE as getErrorStack,t_ as getExpectedDuration,A_ as getFriendlyResourceType,i_ as getRegionInfo,V as getSafeZoneName,H as hasAsciiStableConstructKey,kE as hasErrorCode,kr as hasReservedAppNameSuffix,t as hostsExportPartName,D as imageTagParameterName,Kr as inferContainerFromCandidates,de as isAccountStage,Ve as isAccountTier,TS as isAddressAtDomain,J as isApplicationStack,Qe as isBackupTier,__ as isCodemodStatementType,Z_ as isComplianceIssueStatus,eE as isDeployableServiceExportName,ZT as isFramework,He as isGovernanceTier,Yr as isInfrastructureFile,K_ as isManageablePath,a as isManagedDomainBinding,HT as isOpenNextBucketKey,VT as isOpenNextPatternType,xT as isPatternType,m as isReownedBackupVault,vr as isReservedAppName,AE as isVpcCidrExportName,EE as legacyDeployableServiceExportName,tE as legacyVpcCidrExportName,fe as mapSettledWithConcurrency,ae as maskSensitiveOutput,NE as mintedEc2KeyPairName,vE as normaliseError,n_ as optInRegionWarning,xS as parseDeploymentFailure,h_ as parseDotEnv,a_ as parseGitRemoteUrl,H_ as parseParameterPath,Ne as parseShellArgs,KT as patternBucketConstructId,uT as patternConstructId,fE as projectCapacityIdentityToTarget,zT as recommendPatternForFramework,yE as regionSuffixRejectionMessage,P_ as regions,$T as requiredInputsForFramework,be as resolveSynthEnvironment,PT as schemaGateExitKind,A as serialiseHostsChunks,Te as singleton,De as sleep,w as stackScopedExportName,ve as stageFromWireEnvironment,HE as suffixedAccountName,p_ as suggestRegionForTimezone,ie as tailUtf16Safe,$e as tierDefault,VS as toDeploymentFailureAnalysis,u as toKebab,F as toPascalCase,G as toScreamingSnake,d as toValidDatabaseName,Oe as truncateUtf16Safe,me as truncateWithEllipsis,Cr as upgradeCommand,SE as vpcCidrExportName};

package/dist/infra/deriveContentHashTag.js

@@ -1 +1 @@
-var d=Object.defineProperty;var t=(e,s)=>d(e,"name",{value:s,configurable:!0});function g(e){return{success:!0,data:e}}t(g,"success");function r(e){return{success:!1,error:e}}t(r,"failure");const h="sha256:",n=12,E=new RegExp(`-sha-[0-9a-f]{${n}}$`);function T(e,s,c){if(!e.startsWith(h))return r(new Error(`expected sha256:... digest, got ${e.slice(0,32)}`));const o=e.slice(h.length);if(o.length<n)return r(new Error(`digest hex payload too short (need >=${n} chars, got ${o.length})`));const i=s.trim();if(i==="")return r(new Error("serviceName must be a non-empty string"));let a;if(c!==void 0){const u=c.trim();if(u==="")return r(new Error("target, when supplied, must be a non-empty string; omit the argument instead"));a=u.toLowerCase()}const f=o.slice(0,n).toLowerCase(),m=a!==void 0?`${i.toLowerCase()}-${a}`:i.toLowerCase();return g(`${m}-sha-${f}`)}t(T,"deriveContentHashTag");export{E as CONTENT_HASH_TAG_PATTERN,T as deriveContentHashTag};
+var d=Object.defineProperty;var t=(e,s)=>d(e,"name",{value:s,configurable:!0});import{truncateUtf16Safe as g}from"../textBounds.js";function l(e){return{success:!0,data:e}}t(l,"success");function r(e){return{success:!1,error:e}}t(r,"failure");const f="sha256:",n=12,T=new RegExp(`-sha-[0-9a-f]{${n}}$`);function w(e,s,c){if(!e.startsWith(f))return r(new Error(`expected sha256:... digest, got ${g(e,32)}`));const o=e.slice(f.length);if(o.length<n)return r(new Error(`digest hex payload too short (need >=${n} chars, got ${o.length})`));const i=s.trim();if(i==="")return r(new Error("serviceName must be a non-empty string"));let a;if(c!==void 0){const u=c.trim();if(u==="")return r(new Error("target, when supplied, must be a non-empty string; omit the argument instead"));a=u.toLowerCase()}const m=o.slice(0,n).toLowerCase(),h=a!==void 0?`${i.toLowerCase()}-${a}`:i.toLowerCase();return l(`${h}-sha-${m}`)}t(w,"deriveContentHashTag");export{T as CONTENT_HASH_TAG_PATTERN,w as deriveContentHashTag};

package/dist/infra/ecsTaskReplacement.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The longest each phase of an ECS task's replacement behind a load balancer
+ * may take: the constructs refuse a service that asks for longer at synth,
+ * and the engine's rollout waits are sized for them (FJL-1421).
+ *
+ * ECS replaces such a task in order. The new task registers with its target
+ * group and counts as healthy once it passes one health check, which the load
+ * balancer makes every `interval` (the Elastic Load Balancing user guide,
+ * checked on 2026-10-15). ECS then deregisters the old task, which drains for
+ * the target group's `deregistrationDelay`, and only then sends it the stop
+ * signal, with each container's `stopTimeout` to exit before SIGKILL (the ECS
+ * developer guide, checked on 2026-10-15). Every lane that rolls a service
+ * itself (a code-only deploy, a rollback, a restart) waits a fixed time for
+ * all of that, so deploy-core's tests hold the roll's wait to the sum of these
+ * with time left for the new tasks to start: a limit raised here without the
+ * wait fails there.
+ *
+ * The interval and the drain are the longest defaults: a Fargate target
+ * group's 120-second interval, and the load balancer's own 300-second drain,
+ * which a service that sets no `deregistrationDelay` keeps.
+ */
+export declare const ECS_TASK_REPLACEMENT_LIMITS: {
+    /** A target group's `interval`: a new task waits up to one for its first check. */
+    readonly healthCheckIntervalSeconds: 120;
+    /** A target group's `deregistrationDelay`: an old task drains for it. */
+    readonly deregistrationDelaySeconds: 300;
+    /** A container's `stopTimeout`: ECS waits it out before SIGKILL. */
+    readonly stopTimeoutSeconds: 120;
+};

package/dist/infra/ecsTaskReplacement.js

@@ -0,0 +1 @@
+const e={healthCheckIntervalSeconds:120,deregistrationDelaySeconds:300,stopTimeoutSeconds:120};export{e as ECS_TASK_REPLACEMENT_LIMITS};

package/dist/jsonParseRefusal.d.ts

@@ -0,0 +1,10 @@
+/**
+ * How a refusal describes text that is not valid JSON, without quoting it:
+ * `not valid JSON at line 2, column 3 (612 characters)`, the caller supplying
+ * the subject. V8's `Unexpected token …` message quotes a window of the text,
+ * which can open inside a key the mask anchors on, so a credential there
+ * would print in part (FJL-1106). Only the text's length, and the line and
+ * column V8 gives, are carried, so the result needs no mask, and the parse
+ * error itself must not be attached as a cause.
+ */
+export declare function describeUnparseableJson(content: string, err: unknown): string;

package/dist/jsonParseRefusal.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var o=(e,n)=>c(e,"name",{value:n,configurable:!0});const l=/ \(line (\d+) column (\d+)\)$/;function r(e,n){const t=n instanceof Error?l.exec(n.message):null;return`not valid JSON${t===null?"":` at line ${t[1]}, column ${t[2]}`} (${e.length} characters)`}o(r,"describeUnparseableJson");export{r as describeUnparseableJson};

package/dist/manifest/index.d.ts

@@ -7,4 +7,4 @@
  * the barrel — the package.json `exports` map exposes both subpaths.
  */
 export { DockerBuildSchema, DockerBuildArgValueSchema, DockerBuildSecretRefSchema, DockerBuildPartialSchema, mergeDockerBuild, ManifestServiceSchema, ManifestPatternSchema, ManifestEcrSchema, ManifestLambdaSchema, ManifestStackHashSchema, ResourceMapEntrySchema, FjallManifestSchema, EngineCompatSchema, ManifestCapacityAliasSchema, FJALL_MANIFEST_FILENAME, MANIFEST_SCHEMA_VERSION, MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION, BUILDKIT_SECRET_ID_PATTERN, type DockerBuild, type DockerBuildArgValue, type DockerBuildSecretRef, type DockerBuildPartial, type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ResourceMapEntry, type FjallManifest, type EngineCompat, type ManifestCapacityAlias } from "./schemas.js";
-export { getManifestFilePath, readManifestFile, readManifestFileOutcome, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, parseSchemaGateImageTagsFromManifest, type SchemaGateTagsOutcome, readEngineCompatEnvelope, readManifestAppName, readManifestAppNameOutcome, type ManifestAppNameOutcome, type ManifestDockerService, type ManifestFileReadOutcome, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations, type EngineCompatEnvelope } from "./io.js";
+export { getManifestFilePath, readManifestFile, readManifestFileOutcome, readManifestRecordOutcome, type ManifestRecordOutcome, readManifestComputeList, type ManifestComputeList, type ManifestComputeListOutcome, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, parseSchemaGateImageTagsFromManifest, type SchemaGateTagsOutcome, readEngineCompatEnvelope, readManifestAppName, readManifestAppNameOutcome, type ManifestAppNameOutcome, type ManifestDockerService, type ManifestFileReadOutcome, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations, type EngineCompatEnvelope } from "./io.js";

package/dist/manifest/index.js

@@ -1 +1 @@
-import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as i,DockerBuildPartialSchema as c,mergeDockerBuild as m,ManifestServiceSchema as s,ManifestPatternSchema as n,ManifestEcrSchema as M,ManifestLambdaSchema as S,ManifestStackHashSchema as o,ResourceMapEntrySchema as f,FjallManifestSchema as E,EngineCompatSchema as p,ManifestCapacityAliasSchema as h,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as F,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as d,BUILDKIT_SECRET_ID_PATTERN as A}from"./schemas.js";import{getManifestFilePath as _,readManifestFile as k,readManifestFileOutcome as u,writeManifestFile as I,createEmptyManifest as N,readConstructMap as T,parseDockerServicesFromManifest as g,parseLambdaDockerServicesFromManifest as C,parseLambdaDockerEntriesFromManifest as L,parseDockerDeclarationsFromManifest as R,parseSchemaGateImageTagsFromManifest as B,readEngineCompatEnvelope as P,readManifestAppName as O,readManifestAppNameOutcome as v}from"./io.js";export{A as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,c as DockerBuildPartialSchema,r as DockerBuildSchema,i as DockerBuildSecretRefSchema,p as EngineCompatSchema,l as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,F as MANIFEST_SCHEMA_VERSION,d as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,h as ManifestCapacityAliasSchema,M as ManifestEcrSchema,S as ManifestLambdaSchema,n as ManifestPatternSchema,s as ManifestServiceSchema,o as ManifestStackHashSchema,f as ResourceMapEntrySchema,N as createEmptyManifest,_ as getManifestFilePath,m as mergeDockerBuild,R as parseDockerDeclarationsFromManifest,g as parseDockerServicesFromManifest,L as parseLambdaDockerEntriesFromManifest,C as parseLambdaDockerServicesFromManifest,B as parseSchemaGateImageTagsFromManifest,T as readConstructMap,P as readEngineCompatEnvelope,O as readManifestAppName,v as readManifestAppNameOutcome,k as readManifestFile,u as readManifestFileOutcome,I as writeManifestFile};
+import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as i,DockerBuildPartialSchema as c,mergeDockerBuild as s,ManifestServiceSchema as m,ManifestPatternSchema as n,ManifestEcrSchema as M,ManifestLambdaSchema as o,ManifestStackHashSchema as S,ResourceMapEntrySchema as f,FjallManifestSchema as E,EngineCompatSchema as p,ManifestCapacityAliasSchema as d,FJALL_MANIFEST_FILENAME as h,MANIFEST_SCHEMA_VERSION as l,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as F,BUILDKIT_SECRET_ID_PATTERN as A}from"./schemas.js";import{getManifestFilePath as u,readManifestFile as _,readManifestFileOutcome as k,readManifestRecordOutcome as I,readManifestComputeList as N,writeManifestFile as T,createEmptyManifest as C,readConstructMap as L,parseDockerServicesFromManifest as R,parseLambdaDockerServicesFromManifest as g,parseLambdaDockerEntriesFromManifest as B,parseDockerDeclarationsFromManifest as O,parseSchemaGateImageTagsFromManifest as P,readEngineCompatEnvelope as v,readManifestAppName as b,readManifestAppNameOutcome as y}from"./io.js";export{A as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,c as DockerBuildPartialSchema,r as DockerBuildSchema,i as DockerBuildSecretRefSchema,p as EngineCompatSchema,h as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,l as MANIFEST_SCHEMA_VERSION,F as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,d as ManifestCapacityAliasSchema,M as ManifestEcrSchema,o as ManifestLambdaSchema,n as ManifestPatternSchema,m as ManifestServiceSchema,S as ManifestStackHashSchema,f as ResourceMapEntrySchema,C as createEmptyManifest,u as getManifestFilePath,s as mergeDockerBuild,O as parseDockerDeclarationsFromManifest,R as parseDockerServicesFromManifest,B as parseLambdaDockerEntriesFromManifest,g as parseLambdaDockerServicesFromManifest,P as parseSchemaGateImageTagsFromManifest,L as readConstructMap,v as readEngineCompatEnvelope,b as readManifestAppName,y as readManifestAppNameOutcome,N as readManifestComputeList,_ as readManifestFile,k as readManifestFileOutcome,I as readManifestRecordOutcome,T as writeManifestFile};

package/dist/manifest/io.d.ts

@@ -85,6 +85,58 @@ export interface ManifestDockerService {
      */
     readonly clusterName?: string;
 }
+/**
+ * Completeness-signalled synchronous read of the manifest as a JSON object.
+ * `absent` is proof: nothing exists at the path (`ENOENT`, or `ENOTDIR` for a
+ * path whose directory is not one). Anything else that stops the read is
+ * `unreadable`, never absent: a permission error, a body that does not
+ * parse, a root that is not an object. A consumer whose verdict withholds
+ * work on "nothing declared" must refuse `unreadable`, because the manifest
+ * may declare what it cannot see. On this line the best-effort extractors
+ * below keep their own read, `readManifestRecord`, which folds all three.
+ *
+ * `detail` completes a sentence about the manifest ("… could not be read
+ * (EACCES)", "… is not valid JSON at line 2, column 3 (812 characters)"). It
+ * is pre-masked at construction: a failed read is named by Node's error code,
+ * or by its message through `maskSensitiveOutput(getErrorMessage(error))` when
+ * it carries none, and a body that does not parse is named by its length and
+ * the line and column V8 gives (`describeUnparseableJson`), never by V8's
+ * message, which quotes a window of the input.
+ */
+export type ManifestRecordOutcome = {
+    status: "ok";
+    record: Record<string, unknown>;
+} | {
+    status: "absent";
+} | {
+    status: "unreadable";
+    detail: string;
+};
+export declare function readManifestRecordOutcome(cdkOutPath: string): ManifestRecordOutcome;
+/** The manifest's compute lists, which every manifest carries. */
+export type ManifestComputeList = "services" | "lambdas";
+/**
+ * One of the manifest's compute lists, as the manifest record carries it.
+ * `FjallManifestSchema` requires both lists and `writeManifest`
+ * (`@fjall/components-infrastructure`) is typed by it, and both have been
+ * required since the manifest was introduced (2026-02-08). A list with no
+ * entries is written as `[]`. So a list that is absent, or present but not an
+ * array, is not an empty answer. It is `unreadable`, and a reader whose
+ * verdict gates a deploy refuses it rather than reading it as declaring
+ * nothing.
+ *
+ * `detail` completes a sentence about the manifest, as
+ * `ManifestRecordOutcome`'s does, and names only the list, so it is
+ * identifier-only.
+ */
+export type ManifestComputeListOutcome = {
+    status: "ok";
+    entries: readonly unknown[];
+} | {
+    status: "unreadable";
+    detail: string;
+};
+export declare function readManifestComputeList(record: Readonly<Record<string, unknown>>, list: ManifestComputeList): ManifestComputeListOutcome;
 /**
  * The engine-compatibility envelope, hand-walked from the manifest rather than
  * strict-parsed. The deploy-time chokepoint (`assertEngineCompatibleWithAssembly`

package/dist/manifest/io.js

@@ -1 +1 @@
-var M=Object.defineProperty;var s=(n,e)=>M(n,"name",{value:e,configurable:!0});import{readFile as k,writeFile as E,unlink as N,rename as S,mkdir as w}from"fs/promises";import{readFileSync as p}from"fs";import{dirname as F,join as m}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as x}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as A}from"../constructMap.js";import{FjallManifestSchema as v,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as j,normaliseDockerBuild as y,LAMBDA_ARCHITECTURE_VALUES as C}from"./schemas.js";function h(n){return m(n,l)}s(h,"getManifestFilePath");async function O(n){const e=h(n);if(!await x(e))return{status:"absent"};try{const r=await k(e,"utf-8"),t=JSON.parse(r),a=v.safeParse(t);if(!a.success){const i=f(a.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:a.data}}catch(r){const t=f(d(r));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(O,"readManifestFileOutcome");async function I(n){const e=await O(n);return e.status==="ok"?e.manifest:null}s(I,"readManifestFile");async function U(n,e){const r=h(n),t=`${r}.${Date.now()}.tmp`;await w(F(r),{recursive:!0});try{await E(t,JSON.stringify(e,null,2),"utf-8"),await S(t,r)}catch(a){try{await N(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw a}}s(U,"writeManifestFile");function q(n){return{version:j,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(q,"createEmptyManifest");async function z(n){const e=await I(n);return e?.resourceMap?A(e.resourceMap):new Map}s(z,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function g(n,e){const r=m(n,l);let t;try{t=p(r,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:r});return}let a;try{a=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:r});return}return u(a)?a:void 0}s(g,"readManifestRecord");function T(n){const e=n.engineCompat;if(!u(e))return;const r=e.minimumEngineVersion;if(typeof r!="string"||r.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",a=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:r,...a!==void 0&&{maximumEngineMajor:a},...o!==void 0&&{minimumAwsCdkCli:o}}}s(T,"extractEngineCompat");function Q(n){const e=g(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const r=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),a=T(e);return{manifestVersion:r,engineCompatPresent:t,engineCompat:a}}s(Q,"readEngineCompatEnvelope");function W(n){const e=$(n);return e.status==="ok"?e.appName:void 0}s(W,"readManifestAppName");function $(n){const e=m(n,l);let r;try{r=p(e,"utf-8")}catch(a){const i=a!==null&&typeof a=="object"&&"code"in a?a.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"})}let t;try{t=JSON.parse(r)}catch(a){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s($,"readManifestAppNameOutcome");function D(n){const e=g(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const r=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);a!==void 0&&r.push({name:t.name,docker:a,isLambda:!1,...typeof t.clusterName=="string"&&{clusterName:t.clusterName}})}return r}s(D,"parseDockerServicesFromManifest");function X(n){const e=new Map;for(const{name:r,imageKey:t,docker:a,architecture:i}of b(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:a,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(a)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${r}").`)}return Array.from(e.values())}s(X,"parseLambdaDockerServicesFromManifest");function b(n){const e=g(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const r=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);if(a===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&(C.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),r.push({name:t.name,imageKey:i,docker:a,...o!==void 0&&{architecture:o}})}return r}s(b,"parseLambdaDockerEntriesFromManifest");function Y(n){const e=D(n),r=b(n);return{ecsServices:e,lambdaEntries:r,declaresBuild:e.length>0||r.length>0}}s(Y,"parseDockerDeclarationsFromManifest");function Z(n){const e=m(n,l);let r;try{r=p(e,"utf-8")}catch(i){const o=i.code;return o==="ENOENT"?{outcome:"ok",tags:[]}:{outcome:"manifest-unreadable",reason:`manifest at ${e} exists but could not be read (${o??"unknown error"})`}}let t;try{t=JSON.parse(r)}catch{return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not valid JSON`}}if(!u(t))return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not a JSON object`};if(t.services===void 0)return{outcome:"ok",tags:[]};if(!Array.isArray(t.services))return{outcome:"manifest-unreadable",reason:`manifest at ${e} has a non-array \`services\` field`};const a=new Set;for(const i of t.services)if(u(i)&&i.schemaGateImageTag!==void 0){if(typeof i.schemaGateImageTag!="string"||i.schemaGateImageTag==="")return{outcome:"manifest-unreadable",reason:`manifest at ${e} declares an invalid schemaGateImageTag for service '${typeof i.name=="string"?i.name:"<unnamed>"}'`};a.add(i.schemaGateImageTag)}return{outcome:"ok",tags:[...a].sort()}}s(Z,"parseSchemaGateImageTagsFromManifest");export{q as createEmptyManifest,h as getManifestFilePath,Y as parseDockerDeclarationsFromManifest,D as parseDockerServicesFromManifest,b as parseLambdaDockerEntriesFromManifest,X as parseLambdaDockerServicesFromManifest,Z as parseSchemaGateImageTagsFromManifest,z as readConstructMap,Q as readEngineCompatEnvelope,W as readManifestAppName,$ as readManifestAppNameOutcome,I as readManifestFile,O as readManifestFileOutcome,U as writeManifestFile};
+var M=Object.defineProperty;var s=(n,e)=>M(n,"name",{value:e,configurable:!0});import{readFile as N,writeFile as E,unlink as k,rename as S,mkdir as v}from"fs/promises";import{readFileSync as m}from"fs";import{dirname as w,join as l}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as x}from"../fsHelpers.js";import{getErrorCode as A,getErrorMessage as d}from"../errorUtils.js";import{describeUnparseableJson as F}from"../jsonParseRefusal.js";import{recordToConstructMap as O}from"../constructMap.js";import{FjallManifestSchema as j,FJALL_MANIFEST_FILENAME as p,MANIFEST_SCHEMA_VERSION as C,normaliseDockerBuild as h,LAMBDA_ARCHITECTURE_VALUES as $}from"./schemas.js";function g(n){return l(n,p)}s(g,"getManifestFilePath");async function I(n){const e=g(n);if(!await x(e))return{status:"absent"};try{const r=await N(e,"utf-8"),t=JSON.parse(r),a=j.safeParse(t);if(!a.success){const i=f(a.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:a.data}}catch(r){const t=f(d(r));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(I,"readManifestFileOutcome");async function T(n){const e=await I(n);return e.status==="ok"?e.manifest:null}s(T,"readManifestFile");async function W(n,e){const r=g(n),t=`${r}.${Date.now()}.tmp`;await v(w(r),{recursive:!0});try{await E(t,JSON.stringify(e,null,2),"utf-8"),await S(t,r)}catch(a){try{await k(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw a}}s(W,"writeManifestFile");function X(n){return{version:C,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(X,"createEmptyManifest");async function Y(n){const e=await T(n);return e?.resourceMap?O(e.resourceMap):new Map}s(Y,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function Z(n){let e;try{e=m(g(n),"utf-8")}catch(t){const a=A(t);return a==="ENOENT"||a==="ENOTDIR"?{status:"absent"}:{status:"unreadable",detail:`could not be read (${a??f(d(t))})`}}let r;try{r=JSON.parse(e)}catch(t){return{status:"unreadable",detail:`is ${F(e,t)}`}}return u(r)?{status:"ok",record:r}:{status:"unreadable",detail:"is not a JSON object"}}s(Z,"readManifestRecordOutcome");const J={services:!0,lambdas:!0};function ee(n,e){const r=n[e];return Array.isArray(r)?{status:"ok",entries:r}:{status:"unreadable",detail:r===void 0?`has no \`${e}\` list`:`has a \`${e}\` field that is not a list`}}s(ee,"readManifestComputeList");function y(n,e){const r=l(n,p);let t;try{t=m(r,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:r});return}let a;try{a=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:r});return}return u(a)?a:void 0}s(y,"readManifestRecord");function L(n){const e=n.engineCompat;if(!u(e))return;const r=e.minimumEngineVersion;if(typeof r!="string"||r.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",a=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:r,...a!==void 0&&{maximumEngineMajor:a},...o!==void 0&&{minimumAwsCdkCli:o}}}s(L,"extractEngineCompat");function te(n){const e=y(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const r=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),a=L(e);return{manifestVersion:r,engineCompatPresent:t,engineCompat:a}}s(te,"readEngineCompatEnvelope");function ne(n){const e=D(n);return e.status==="ok"?e.appName:void 0}s(ne,"readManifestAppName");function D(n){const e=l(n,p);let r;try{r=m(e,"utf-8")}catch(a){const i=a!==null&&typeof a=="object"&&"code"in a?a.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"})}let t;try{t=JSON.parse(r)}catch(a){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s(D,"readManifestAppNameOutcome");function P(n){const e=y(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const r=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const a=h(t.docker);a!==void 0&&r.push({name:t.name,docker:a,isLambda:!1,...typeof t.clusterName=="string"&&{clusterName:t.clusterName}})}return r}s(P,"parseDockerServicesFromManifest");function re(n){const e=new Map;for(const{name:r,imageKey:t,docker:a,architecture:i}of b(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:a,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(a)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${r}").`)}return Array.from(e.values())}s(re,"parseLambdaDockerServicesFromManifest");function b(n){const e=y(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const r=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const a=h(t.docker);if(a===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&($.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),r.push({name:t.name,imageKey:i,docker:a,...o!==void 0&&{architecture:o}})}return r}s(b,"parseLambdaDockerEntriesFromManifest");function ae(n){const e=P(n),r=b(n);return{ecsServices:e,lambdaEntries:r,declaresBuild:e.length>0||r.length>0}}s(ae,"parseDockerDeclarationsFromManifest");function ie(n){const e=l(n,p);let r;try{r=m(e,"utf-8")}catch(i){const o=i.code;return o==="ENOENT"?{outcome:"ok",tags:[]}:{outcome:"manifest-unreadable",reason:`manifest at ${e} exists but could not be read (${o??"unknown error"})`}}let t;try{t=JSON.parse(r)}catch{return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not valid JSON`}}if(!u(t))return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not a JSON object`};if(t.services===void 0)return{outcome:"ok",tags:[]};if(!Array.isArray(t.services))return{outcome:"manifest-unreadable",reason:`manifest at ${e} has a non-array \`services\` field`};const a=new Set;for(const i of t.services)if(u(i)&&i.schemaGateImageTag!==void 0){if(typeof i.schemaGateImageTag!="string"||i.schemaGateImageTag==="")return{outcome:"manifest-unreadable",reason:`manifest at ${e} declares an invalid schemaGateImageTag for service '${typeof i.name=="string"?i.name:"<unnamed>"}'`};a.add(i.schemaGateImageTag)}return{outcome:"ok",tags:[...a].sort()}}s(ie,"parseSchemaGateImageTagsFromManifest");export{X as createEmptyManifest,g as getManifestFilePath,ae as parseDockerDeclarationsFromManifest,P as parseDockerServicesFromManifest,b as parseLambdaDockerEntriesFromManifest,re as parseLambdaDockerServicesFromManifest,ie as parseSchemaGateImageTagsFromManifest,Y as readConstructMap,te as readEngineCompatEnvelope,ne as readManifestAppName,D as readManifestAppNameOutcome,ee as readManifestComputeList,T as readManifestFile,I as readManifestFileOutcome,Z as readManifestRecordOutcome,W as writeManifestFile};

package/dist/naming/connectionKeySuffix.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The regex source of the ordinal suffix a connection's env key carries: `_` then
+ * digits. {@link connectionEnvSuffix} writes it, {@link connectionKeyOrdinal} reads it,
+ * and the credential mask reads a key that ends in it as the key it extends, so
+ * `DATABASE_PASSWORD_2` is the credential `DATABASE_PASSWORD` is. The digit run is
+ * bounded, so a long one costs a fixed amount inside the mask's lookbehinds.
+ */
+export declare const CONNECTION_KEY_SUFFIX_SOURCE: string;
+/**
+ * The `_N` connection env-key suffix scheme, shared by every connection
+ * emitter (database, storage, messaging) AND the codemod connection edit
+ * (`generator/src/codemod/edits/connectResourceToCompute.ts`): the first
+ * connection of a type gets no suffix, the Nth gets `_N`. `index` is zero-based position.
+ * Drift between the two lanes silently desynchronises surgically-wired env
+ * keys from regenerated ones.
+ */
+export declare function connectionEnvSuffix(index: number): string;
+/**
+ * Inverse of {@link connectionEnvSuffix}: the 1-based ordinal a key encodes
+ * for `base` (`DATABASE_HOST` → 1, `DATABASE_HOST_2` → 2), or `undefined`
+ * when the key does not belong to that base's suffix scheme.
+ */
+export declare function connectionKeyOrdinal(key: string, base: string): number | undefined;

package/dist/naming/connectionKeySuffix.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var r=(n,t)=>i(n,"name",{value:t,configurable:!0});const o=String.raw`_\d{1,64}`,c=new RegExp(`^${o}$`);function u(n){return n===0?"":`_${String(n+1)}`}r(u,"connectionEnvSuffix");function s(n,t){if(n===t)return 1;if(!n.startsWith(t))return;const e=n.slice(t.length);return c.test(e)?parseInt(e.slice(1),10):void 0}r(s,"connectionKeyOrdinal");export{o as CONNECTION_KEY_SUFFIX_SOURCE,u as connectionEnvSuffix,s as connectionKeyOrdinal};

package/dist/securityHelpers.js

@@ -1 +1 @@
-var p=Object.defineProperty;var c=(t,_)=>p(t,"name",{value:_,configurable:!0});const D=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function h(t){return Object.fromEntries(Object.entries(t).filter(([_])=>!D.has(_.toUpperCase())))}c(h,"filterDangerousEnvVars");const P=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,T=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,L=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,$=/(fjall:\/\/plans\/)[^\s"'<>\\]+/g,s="***",l="[REDACTED]",g=`-----BEGIN ${l} PRIVATE KEY-----...-----END ${l} PRIVATE KEY-----`,R=String.raw`(?:next|continuation|pagination|page|forward|backward)+token`,S=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,i=String.raw`password|passwd|secret|api[_-]?key|token|auth|credential`,N=String.raw`arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:`,w=new RegExp(String.raw`(?<!"${R}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*(?:${i})":\s*")`+S+String.raw`(?:[^"\\]|\\.)+`,"gi"),o=String.raw`(?:\\?["'])?`,I=String.raw`(?:[^\s"'\\]|\\[^\s"'nrt])+`,O=new RegExp(String.raw`(?<!${R}\s*[=:]\s*${o})`+String.raw`(?<!${N}(?:${i})\s*[=:]\s*${o})`+String.raw`(?<=(?<!/)(?:${i})\s*[=:]\s*${o})`+S+I,"gi"),f=new RegExp(String.raw`(?<!${N})(?<![a-zA-Z])(${i})([=:])${o}${I}`,"gi");function k(t){return t.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>g).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>g).replace(/(\w+:\/\/[^:\s"']+:)[^@\s"']+(@)/gi,(_,e,a)=>`${e}${s}${a}`).replace(f,(_,e,a)=>`${e}${a}${s}`).replace(w,s).replace(O,s).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(_,e)=>`${e}${s}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(_,e,a)=>`${e}_${a}_${s}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${s}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,s).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(_,e)=>`${e}${s}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,s).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,s).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,s).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,s).replace(T,(_,e)=>`${e}${s}`).replace(L,()=>`fj_${s}`).replace($,(_,e)=>`${e}${s}`)}c(k,"maskSensitiveOutput");function G(t){const _=[];let e="",a=!1,r=!1,A=!1,n=!1;for(const E of t){if(A){e+=E,A=!1;continue}if(E==="\\"&&!a){A=!0;continue}if(E==="'"&&!r){a=!a,n=!0;continue}if(E==='"'&&!a){r=!r,n=!0;continue}if(E===" "&&!a&&!r){(e||n)&&(_.push(e),e="",n=!1);continue}e+=E}if(a||r)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${t.slice(0,80)}`);if(A)throw new Error(`Trailing backslash in command: ${t.slice(0,80)}`);return(e||n)&&_.push(e),_}c(G,"parseShellArgs");export{D as DANGEROUS_ENV_VARS,s as MASKED_VALUE_MARKER,l as REDACTED_KEY_SENTINEL,P as SCOPED_TOKEN_REGEX,h as filterDangerousEnvVars,k as maskSensitiveOutput,G as parseShellArgs};
+var T=Object.defineProperty;var c=(s,t)=>T(s,"name",{value:t,configurable:!0});import{CONNECTION_KEY_SUFFIX_SOURCE as r}from"./naming/connectionKeySuffix.js";import{truncateUtf16Safe as $}from"./textBounds.js";const L=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function Z(s){return Object.fromEntries(Object.entries(s).filter(([t])=>!L.has(t.toUpperCase())))}c(Z,"filterDangerousEnvVars");const b=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,O=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,f=/\bfj_[0-9a-f]{8}_[0-9a-f]{48}\b/gi,w=/(fjall:\/\/plans\/)[^\s"'<>\\]+/g,_="***",R="[REDACTED]",l=`-----BEGIN ${R} PRIVATE KEY-----...-----END ${R} PRIVATE KEY-----`,N=String.raw`(?:next|continuation|pagination|page|forward|backward)+token(?:${r})?`,g=String.raw`(?!ghu_|ghs_|ghp_|gho_|github_pat_|(?:sk|rk)_(?:live|test)_|whsec_|fjall_(?:ak|dk)_|fj_[0-9a-f]{8}_|AKIA|ASIA|%[a-zA-Z])`,u=String.raw`password|passwd|secret|api[_-]?key|token|auth|credential`,i=String.raw`(?:${u})(?:${r})?`,h=new RegExp(String.raw`(?<=aws_secret_access_key(?:${r})?\s*=\s*["']?|SecretAccessKey(?:${r})?[=:]\s*|"(?:aws)?secretAccessKey(?:${r})?":\s*"|"aws_secret_access_key(?:${r})?":\s*")[A-Za-z0-9/+=]{40,}`,"gi"),I=String.raw`arn:aws[a-z-]*:[a-z0-9-]+:[a-z0-9-]*:[0-9]*:`,C=new RegExp(String.raw`(?<!"${N}":\s*")`+String.raw`(?<="[a-zA-Z0-9_-]*${i}":\s*")`+g+String.raw`(?:[^"\\]|\\.)+`,"gi"),S=String.raw`(?:\\?["'])?`,p=String.raw`(?:[^\s"'\\]|\\[^\s"'nrt])+`,P=new RegExp(String.raw`(?<!${N}\s*[=:]\s*${S})`+String.raw`(?<!${I}${i}\s*[=:]\s*${S})`+String.raw`(?<=(?<!/)${i}\s*[=:]\s*${S})`+g+p,"gi"),K=new RegExp(String.raw`(?<!${I})(?<![a-zA-Z])(${i})([=:])${S}${p}`,"gi");function Y(s){return s.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>l).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>l).replace(/(\w+:\/\/[^:\s"']+:)[^@\s"']+(@)/gi,(t,e,E)=>`${e}${_}${E}`).replace(K,(t,e,E)=>`${e}${E}${_}`).replace(C,_).replace(P,_).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(t,e)=>`${e}${_}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(t,e,E)=>`${e}_${E}_${_}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${_}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,_).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(t,e)=>`${e}${_}`).replace(h,_).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,_).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,_).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,_).replace(O,(t,e)=>`${e}${_}`).replace(f,()=>`fj_${_}`).replace(w,(t,e)=>`${e}${_}`)}c(Y,"maskSensitiveOutput");const k=80;function D(s){return $(Y(s),k)}c(D,"echoRejectedCommand");function B(s){const t=[];let e="",E=!1,n=!1,o=!1,A=!1;for(const a of s){if(o){e+=a,o=!1;continue}if(a==="\\"&&!E){o=!0;continue}if(a==="'"&&!n){E=!E,A=!0;continue}if(a==='"'&&!E){n=!n,A=!0;continue}if(a===" "&&!E&&!n){(e||A)&&(t.push(e),e="",A=!1);continue}e+=a}if(E||n)throw new Error(`Unbalanced ${E?"single":"double"} quote in command: ${D(s)}`);if(o)throw new Error(`Trailing backslash in command: ${D(s)}`);return(e||A)&&t.push(e),t}c(B,"parseShellArgs");export{L as DANGEROUS_ENV_VARS,_ as MASKED_VALUE_MARKER,R as REDACTED_KEY_SENTINEL,b as SCOPED_TOKEN_REGEX,Z as filterDangerousEnvVars,Y as maskSensitiveOutput,B as parseShellArgs};

package/dist/textBounds.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Bounds on text, counted in UTF-16 code units as a string's `.length` counts
+ * them, and cut only between code points. A cut between the two halves of a
+ * surrogate pair leaves a lone surrogate, which `JSON.stringify` writes as a
+ * `\u` escape: PostgreSQL's `jsonb` refuses that escape (22P02), and so does
+ * ClickHouse's `JSONEachRow` (measured on 17.10 and 26.3.17), while a UTF-8
+ * encoder writes U+FFFD in its place.
+ *
+ * zod's `.max()` reads `.length` before zod 4.5.0 and counts code points from
+ * it (measured at 4.4.3, 4.5.0 and 4.6.7). Text within `n` units holds at
+ * most `n` code points, so bounded text passes `.max(n)` under either.
+ *
+ * Imports nothing, so the root barrel stays browser-safe.
+ */
+/**
+ * `value` cut to at most `max` UTF-16 code units. When the cut would keep the
+ * first half of a surrogate pair without the second, that half goes too, so
+ * the result can be one unit short of `max`. A string within the bound is
+ * returned as it is, and a `max` below zero reads as zero. Surrogates the cut
+ * does not reach are left alone: this bounds text, it does not repair it.
+ */
+export declare function truncateUtf16Safe(value: string, max: number): string;
+/**
+ * `text` bounded to at most `maxChars` UTF-16 code units, with the cut marked:
+ * a longer text is cut between code points ({@link truncateUtf16Safe}) and
+ * ends in `…`, the marker counted inside `maxChars`. Text that fits is
+ * returned as it is, with no marker. A bound too small to hold the marker
+ * gets a bare cut.
+ */
+export declare function truncateWithEllipsis(text: string, maxChars: number): string;
+/**
+ * The last `max` UTF-16 code units of `value` at most. When the cut would keep
+ * the second half of a surrogate pair without the first, that half goes too,
+ * so the result can be one unit short of `max`. A string within the bound is
+ * returned as it is, and a `max` below zero reads as zero. Surrogates the cut
+ * does not reach are left alone, because this bounds text and does not
+ * repair it.
+ */
+export declare function tailUtf16Safe(value: string, max: number): string;
+/**
+ * `text` bounded to at most `maxChars` UTF-16 code units from its end. A
+ * longer text keeps its tail, cut between code points ({@link tailUtf16Safe}),
+ * and starts with `…`, the marker counted inside `maxChars`. Text that fits is
+ * returned as it is, with no marker. A bound too small to hold the marker gets
+ * a bare cut.
+ */
+export declare function tailWithEllipsis(text: string, maxChars: number): string;

package/dist/textBounds.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var e=(n,t)=>c(n,"name",{value:t,configurable:!0});const T="\u2026";function u(n){return n>=55296&&n<=56319}e(u,"isHighSurrogate");function A(n){return n>=56320&&n<=57343}e(A,"isLowSurrogate");function f(n,t){const r=Math.max(0,t);if(n.length<=r)return n;const i=u(n.charCodeAt(r-1))?r-1:r;return n.slice(0,i)}e(f,"truncateUtf16Safe");function g(n,t){return n.length<=t?n:t<1?f(n,t):`${f(n,t-1)}\u2026`}e(g,"truncateWithEllipsis");function o(n,t){const r=Math.max(0,t);if(n.length<=r)return n;const i=n.length-r,R=A(n.charCodeAt(i))?i+1:i;return n.slice(R)}e(o,"tailUtf16Safe");function h(n,t){return n.length<=t?n:t<1?o(n,t):`\u2026${o(n,t-1)}`}e(h,"tailWithEllipsis");export{o as tailUtf16Safe,h as tailWithEllipsis,f as truncateUtf16Safe,g as truncateWithEllipsis};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "39.0.8",
+  "version": "39.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",