@fjall/util 7.2.0 → 7.3.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "dbfc9fe91717c8e62437d979ef93c5e47ec43c9e2bfaf9cd239f6ff8d05de506",
+  "hash": "dd4b6f4216f4e2a95fadfd0b75bff3b3c60bcde2293836647a4b358194e9d1b8",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -60,7 +60,7 @@
     "src/errorUtils.ts": "c601f2905c74b8d0",
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
-    "src/index.ts": "80f518c9eb6f13e6",
+    "src/index.ts": "b53459f372672363",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "125c099da0e17ac1",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
@@ -99,12 +99,12 @@
     "src/repo/scanTypes.ts": "1fda805a7d8de93b",
     "src/resourceCategorisation.ts": "a140d1b3cb38be33",
     "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "acbf209255468ff4",
+    "src/securityHelpers.ts": "ee2ab9ffd53119fb",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "59b911cb627059ca",
+    "package.json": "3a8f986a81a80c42",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "89286d0f2d794900630136797d4bbcbbfbf2a17a288efbd121621ea0f3b6ac47",
+  "outputHash": "6f5fc5d5e93c66a4396906af84d0afea9a4ab6b6eae10c7993e6dca435150b04",
   "outputFileCount": 187
 }

package/dist/.minified

@@ -1 +1 @@
-93 files minified at 2026-08-06T02:33:46.620Z
+93 files minified at 2026-08-06T23:10:24.976Z

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { findAccountNameCollision, type AccountNameCollision } from "./naming/ac
 export { defaultConnectedAccountName, suffixedAccountName, REGION_SHORT_CODES, findTrailingRegionShortCode, regionSuffixRejectionMessage } from "./naming/connectedAccountName.js";
 export { normaliseError, getErrorMessage, hasErrorCode, getErrorCode, getErrorStack, formatErrorString } from "./errorUtils.js";
 export { singleton } from "./async/singleton.js";
-export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
+export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSensitiveOutput, parseShellArgs, REDACTED_KEY_SENTINEL, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
 export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, stageFromWireEnvironment, accountTier, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as E,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as R,TOKEN_STDERR_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as O,toKebab as P,toValidDatabaseName as s,toScreamingSnake as c,capitalise as p,getSafeZoneName as I,accountConstructKey as f,hasAsciiStableConstructKey as g}from"./naming/caseConversion.js";import{CAPACITY_SLOT_PATTERN as M,CAPACITY_SLOT_MAX_LENGTH as d,DEFAULT_CAPACITY_SLOT as x,CAPACITY_ANCHOR_PATTERN as u,CAPACITY_ANCHOR_MAX_LENGTH as U,CAPACITY_IDENTITY_CONTEXT_KEY as L,CapacityIdentityPinSchema as V,CapacityIdentityWireSchema as l,CapacityIdentityConfigSchema as G,projectCapacityIdentityToTarget as h}from"./capacityIdentity.js";import{findAccountNameCollision as H}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as v,suffixedAccountName as y,REGION_SHORT_CODES as X,findTrailingRegionShortCode as b,regionSuffixRejectionMessage as K}from"./naming/connectedAccountName.js";import{normaliseError as W,getErrorMessage as k,hasErrorCode as j,getErrorCode as z,getErrorStack as Q,formatErrorString as Z}from"./errorUtils.js";import{singleton as w}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as $,filterDangerousEnvVars as ee,maskSensitiveOutput as re,parseShellArgs as Ee,SCOPED_TOKEN_REGEX as te}from"./securityHelpers.js";import{sleep as _e}from"./async/sleep.js";import{mapSettledWithConcurrency as Ae}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Te,STRUCTURAL_ENVIRONMENTS as ie,ACCOUNT_STAGES as Re,ACCOUNT_STAGE_LABELS as ne,isAccountStage as Ne,ACCOUNT_TIERS as Ce,AccountTierSchema as me,isAccountTier as Oe,GOVERNANCE_ACCOUNT_TIERS as Pe,isGovernanceTier as se,environmentToTier as ce,stageFromWireEnvironment as pe,accountTier as Ie,getEnvironmentLabel as fe,ACCOUNT_ROLES as ge}from"./environments.js";import{RESOURCE_CATEGORIES as Me,categoriseResource as de,getExpectedDuration as xe,getFriendlyResourceType as ue}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Le}from"./repo/gitRemoteParser.js";import{abbreviateRegion as le,AWS_REGIONS_METADATA as Ge,DEFAULT_REGION as he,getRegionInfo as Fe,MAX_SECONDARY_REGIONS as He,OPT_IN_REGION_CODES as Ye,optInRegionWarning as ve,regions as ye,suggestRegionForTimezone as Xe}from"./infra/regions.js";import{SCOPE_VALUES as Ke,MACHINE_ONLY_SCOPES as Be,USER_GRANTABLE_SCOPES as We,GOVERNANCE_SCOPE_REQUIRED_CODE as ke}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as ze,SECRET_NAME_ERROR as Qe,SSM_COMPONENT_PATTERN as Ze,SSM_COMPONENT_ERROR as qe,SSM_STANDARD_MAX_VALUE_BYTES as we,SecretNamespaceSchema as Je,buildNamespaceParts as $e,buildParameterPath as er,parseParameterPath as rr,isManageablePath as Er,parseDotEnv as tr,escapeDotEnvValue as or}from"./secrets.js";import{ConnectionWireSchema as ar,ConnectionsListResponseSchema as Ar}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as Tr,deriveTargets as ir,deriveAllTargets as Rr,environmentOrTier as nr,findTarget as Nr,generateTargetName as Cr}from"./targets.js";import{buildAppConfigPath as Or}from"./repo/appPath.js";import{findInfrastructurePaths as sr,findBoundaryPath as cr,isInfrastructureFile as pr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as fr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Dr,RESERVED_APP_NAME_MESSAGE as Mr,isReservedAppName as dr,RESERVED_APP_NAME_SUFFIX as xr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ur,hasReservedAppNameSuffix as Ur}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Vr,CONTENT_HASH_TAG_PATTERN as lr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as hr,DeployModeSchema as Fr,IMAGE_TAG_PATTERN as Hr,ImageTagSchema as Yr,ServiceArtefactSchema as vr,ServiceArtefactsSchema as yr,ARTEFACT_OUTPUT_FIELDS as Xr,artefactOutputKey as br}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Br,EXPECTED_SCHEMA_VERSION_ENV as Wr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as kr,EXPECTED_CH_SCHEMA_VERSION_ENV as jr,SCHEMA_ADMIN_USER_ENV as zr,SCHEMA_ADMIN_PASSWORD_ENV as Qr,PRISMA_MIGRATION_DIR_RE as Zr,CLICKHOUSE_MIGRATION_SKIP_RE as qr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Jr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as eE,PATTERN_TYPES as rE,isPatternType as EE,PATTERN_REGISTRY as tE,DEPLOYABLE_PATTERN_TYPES as oE,OPENNEXT_PATTERN_TYPES as _E,isOpenNextPatternType as aE,STATIC_SITE_ROUTING_VALUES as AE}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as TE,defaultFormsFromAddress as iE,defaultFormsCorsOrigin as RE,isAddressAtDomain as nE}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as CE,DEV_SUBSTRATE_PARAMS_FILENAME as mE,DevSubstrateSynthPropsSchema as OE,DevSubstrateParamsSchema as PE}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as cE}from"./devSubstrate/entrypoint.js";export{ge as ACCOUNT_ROLES,Re as ACCOUNT_STAGES,Te as ACCOUNT_STAGES_WITH_ROOT,ne as ACCOUNT_STAGE_LABELS,Ce as ACCOUNT_TIERS,R as APPROVAL_TOKEN_OUTPUT_PREFIX,Xr as ARTEFACT_OUTPUT_FIELDS,Ge as AWS_REGIONS_METADATA,me as AccountTierSchema,T as BACKUP_VAULT_NAME,U as CAPACITY_ANCHOR_MAX_LENGTH,u as CAPACITY_ANCHOR_PATTERN,L as CAPACITY_IDENTITY_CONTEXT_KEY,d as CAPACITY_SLOT_MAX_LENGTH,M as CAPACITY_SLOT_PATTERN,qr as CLICKHOUSE_MIGRATION_SKIP_RE,lr as CONTENT_HASH_TAG_PATTERN,G as CapacityIdentityConfigSchema,V as CapacityIdentityPinSchema,l as CapacityIdentityWireSchema,ar as ConnectionWireSchema,Ar as ConnectionsListResponseSchema,$ as DANGEROUS_ENV_VARS,x as DEFAULT_CAPACITY_SLOT,TE as DEFAULT_FORMS_FROM_LOCAL_PART,he as DEFAULT_REGION,oE as DEPLOYABLE_PATTERN_TYPES,hr as DEPLOY_MODES,cE as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,mE as DEV_SUBSTRATE_PARAMS_FILENAME,CE as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,E as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,Fr as DeployModeSchema,PE as DevSubstrateParamsSchema,OE as DevSubstrateSynthPropsSchema,jr as EXPECTED_CH_SCHEMA_VERSION_ENV,Wr as EXPECTED_SCHEMA_VERSION_ENV,kr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Pe as GOVERNANCE_ACCOUNT_TIERS,ke as GOVERNANCE_SCOPE_REQUIRED_CODE,Hr as IMAGE_TAG_PATTERN,Yr as ImageTagSchema,Be as MACHINE_ONLY_SCOPES,He as MAX_SECONDARY_REGIONS,Br as MIGRATION_SNAPSHOT_NAME_PREFIX,_E as OPENNEXT_PATTERN_TYPES,Ye as OPT_IN_REGION_CODES,tE as PATTERN_REGISTRY,rE as PATTERN_TYPES,eE as PATTERN_TYPE_VALUES,Jr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Zr as PRISMA_MIGRATION_DIR_RE,X as REGION_SHORT_CODES,Dr as RESERVED_APP_NAMES,Mr as RESERVED_APP_NAME_MESSAGE,xr as RESERVED_APP_NAME_SUFFIX,ur as RESERVED_APP_NAME_SUFFIX_MESSAGE,Me as RESOURCE_CATEGORIES,Qr as SCHEMA_ADMIN_PASSWORD_ENV,zr as SCHEMA_ADMIN_USER_ENV,te as SCOPED_TOKEN_REGEX,Ke as SCOPE_VALUES,Qe as SECRET_NAME_ERROR,ze as SECRET_NAME_PATTERN,qe as SSM_COMPONENT_ERROR,Ze as SSM_COMPONENT_PATTERN,we as SSM_STANDARD_MAX_VALUE_BYTES,AE as STATIC_SITE_ROUTING_VALUES,ie as STRUCTURAL_ENVIRONMENTS,Je as SecretNamespaceSchema,vr as ServiceArtefactSchema,yr as ServiceArtefactsSchema,n as TOKEN_STDERR_PREFIX,We as USER_GRANTABLE_SCOPES,le as abbreviateRegion,f as accountConstructKey,Ie as accountTier,br as artefactOutputKey,Or as buildAppConfigPath,$e as buildNamespaceParts,er as buildParameterPath,p as capitalise,de as categoriseResource,v as defaultConnectedAccountName,RE as defaultFormsCorsOrigin,iE as defaultFormsFromAddress,Rr as deriveAllTargets,Vr as deriveContentHashTag,Tr as deriveRegionsFromOrgConfig,ir as deriveTargets,nr as environmentOrTier,ce as environmentToTier,or as escapeDotEnvValue,ee as filterDangerousEnvVars,H as findAccountNameCollision,cr as findBoundaryPath,sr as findInfrastructurePaths,Nr as findTarget,b as findTrailingRegionShortCode,Z as formatErrorString,Cr as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,fe as getEnvironmentLabel,z as getErrorCode,k as getErrorMessage,Q as getErrorStack,xe as getExpectedDuration,ue as getFriendlyResourceType,Fe as getRegionInfo,I as getSafeZoneName,g as hasAsciiStableConstructKey,j as hasErrorCode,Ur as hasReservedAppNameSuffix,C as imageTagParameterName,fr as inferContainerFromCandidates,Ne as isAccountStage,Oe as isAccountTier,nE as isAddressAtDomain,se as isGovernanceTier,pr as isInfrastructureFile,Er as isManageablePath,a as isManagedDomainBinding,aE as isOpenNextPatternType,EE as isPatternType,dr as isReservedAppName,Ae as mapSettledWithConcurrency,re as maskSensitiveOutput,W as normaliseError,ve as optInRegionWarning,tr as parseDotEnv,Le as parseGitRemoteUrl,rr as parseParameterPath,Ee as parseShellArgs,h as projectCapacityIdentityToTarget,K as regionSuffixRejectionMessage,ye as regions,w as singleton,_e as sleep,pe as stageFromWireEnvironment,y as suffixedAccountName,Xe as suggestRegionForTimezone,P as toKebab,O as toPascalCase,c as toScreamingSnake,s as toValidDatabaseName};
+import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as A,DOMAIN_DEPLOY_DEFAULT_PHASE as a}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as O,toKebab as P,toValidDatabaseName as s,toScreamingSnake as c,capitalise as p,getSafeZoneName as I,accountConstructKey as f,hasAsciiStableConstructKey as D}from"./naming/caseConversion.js";import{CAPACITY_SLOT_PATTERN as M,CAPACITY_SLOT_MAX_LENGTH as d,DEFAULT_CAPACITY_SLOT as x,CAPACITY_ANCHOR_PATTERN as L,CAPACITY_ANCHOR_MAX_LENGTH as U,CAPACITY_IDENTITY_CONTEXT_KEY as u,CapacityIdentityPinSchema as V,CapacityIdentityWireSchema as l,CapacityIdentityConfigSchema as G,projectCapacityIdentityToTarget as h}from"./capacityIdentity.js";import{findAccountNameCollision as Y}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as v,suffixedAccountName as y,REGION_SHORT_CODES as X,findTrailingRegionShortCode as K,regionSuffixRejectionMessage as b}from"./naming/connectedAccountName.js";import{normaliseError as W,getErrorMessage as k,hasErrorCode as j,getErrorCode as z,getErrorStack as Q,formatErrorString as Z}from"./errorUtils.js";import{singleton as w}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as $,filterDangerousEnvVars as ee,MASKED_VALUE_MARKER as Ee,maskSensitiveOutput as re,parseShellArgs as te,REDACTED_KEY_SENTINEL as oe,SCOPED_TOKEN_REGEX as _e}from"./securityHelpers.js";import{sleep as ae}from"./async/sleep.js";import{mapSettledWithConcurrency as Te}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as ie,STRUCTURAL_ENVIRONMENTS as ne,ACCOUNT_STAGES as Ne,ACCOUNT_STAGE_LABELS as Ce,isAccountStage as me,ACCOUNT_TIERS as Oe,AccountTierSchema as Pe,isAccountTier as se,GOVERNANCE_ACCOUNT_TIERS as ce,isGovernanceTier as pe,environmentToTier as Ie,stageFromWireEnvironment as fe,accountTier as De,getEnvironmentLabel as ge,ACCOUNT_ROLES as Me}from"./environments.js";import{RESOURCE_CATEGORIES as xe,categoriseResource as Le,getExpectedDuration as Ue,getFriendlyResourceType as ue}from"./resourceCategorisation.js";import{parseGitRemoteUrl as le}from"./repo/gitRemoteParser.js";import{abbreviateRegion as he,AWS_REGIONS_METADATA as Fe,DEFAULT_REGION as Ye,getRegionInfo as He,MAX_SECONDARY_REGIONS as ve,OPT_IN_REGION_CODES as ye,optInRegionWarning as Xe,regions as Ke,suggestRegionForTimezone as be}from"./infra/regions.js";import{SCOPE_VALUES as We,MACHINE_ONLY_SCOPES as ke,USER_GRANTABLE_SCOPES as je,GOVERNANCE_SCOPE_REQUIRED_CODE as ze}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as Ze,SECRET_NAME_ERROR as qe,SSM_COMPONENT_PATTERN as we,SSM_COMPONENT_ERROR as Je,SSM_STANDARD_MAX_VALUE_BYTES as $e,SecretNamespaceSchema as eE,buildNamespaceParts as EE,buildParameterPath as rE,parseParameterPath as tE,isManageablePath as oE,parseDotEnv as _E,escapeDotEnvValue as AE}from"./secrets.js";import{ConnectionWireSchema as SE,ConnectionsListResponseSchema as TE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as iE,deriveTargets as nE,deriveAllTargets as NE,environmentOrTier as CE,findTarget as mE,generateTargetName as OE}from"./targets.js";import{buildAppConfigPath as sE}from"./repo/appPath.js";import{findInfrastructurePaths as pE,findBoundaryPath as IE,isInfrastructureFile as fE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as gE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as dE,RESERVED_APP_NAME_MESSAGE as xE,isReservedAppName as LE,RESERVED_APP_NAME_SUFFIX as UE,RESERVED_APP_NAME_SUFFIX_MESSAGE as uE,hasReservedAppNameSuffix as VE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as GE,CONTENT_HASH_TAG_PATTERN as hE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as YE,DeployModeSchema as HE,IMAGE_TAG_PATTERN as vE,ImageTagSchema as yE,ServiceArtefactSchema as XE,ServiceArtefactsSchema as KE,ARTEFACT_OUTPUT_FIELDS as bE,artefactOutputKey as BE}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as kE,EXPECTED_SCHEMA_VERSION_ENV as jE,EXPECTED_SCHEMA_VERSION_TOOL_ENV as zE,EXPECTED_CH_SCHEMA_VERSION_ENV as QE,SCHEMA_ADMIN_USER_ENV as ZE,SCHEMA_ADMIN_PASSWORD_ENV as qE,PRISMA_MIGRATION_DIR_RE as wE,CLICKHOUSE_MIGRATION_SKIP_RE as JE}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as er}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as rr,PATTERN_TYPES as tr,isPatternType as or,PATTERN_REGISTRY as _r,DEPLOYABLE_PATTERN_TYPES as Ar,OPENNEXT_PATTERN_TYPES as ar,isOpenNextPatternType as Sr,STATIC_SITE_ROUTING_VALUES as Tr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as ir,defaultFormsFromAddress as nr,defaultFormsCorsOrigin as Nr,isAddressAtDomain as Cr}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Or,DEV_SUBSTRATE_PARAMS_FILENAME as Pr,DevSubstrateSynthPropsSchema as sr,DevSubstrateParamsSchema as cr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as Ir}from"./devSubstrate/entrypoint.js";export{Me as ACCOUNT_ROLES,Ne as ACCOUNT_STAGES,ie as ACCOUNT_STAGES_WITH_ROOT,Ce as ACCOUNT_STAGE_LABELS,Oe as ACCOUNT_TIERS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,bE as ARTEFACT_OUTPUT_FIELDS,Fe as AWS_REGIONS_METADATA,Pe as AccountTierSchema,T as BACKUP_VAULT_NAME,U as CAPACITY_ANCHOR_MAX_LENGTH,L as CAPACITY_ANCHOR_PATTERN,u as CAPACITY_IDENTITY_CONTEXT_KEY,d as CAPACITY_SLOT_MAX_LENGTH,M as CAPACITY_SLOT_PATTERN,JE as CLICKHOUSE_MIGRATION_SKIP_RE,hE as CONTENT_HASH_TAG_PATTERN,G as CapacityIdentityConfigSchema,V as CapacityIdentityPinSchema,l as CapacityIdentityWireSchema,SE as ConnectionWireSchema,TE as ConnectionsListResponseSchema,$ as DANGEROUS_ENV_VARS,x as DEFAULT_CAPACITY_SLOT,ir as DEFAULT_FORMS_FROM_LOCAL_PART,Ye as DEFAULT_REGION,Ar as DEPLOYABLE_PATTERN_TYPES,YE as DEPLOY_MODES,Ir as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,Pr as DEV_SUBSTRATE_PARAMS_FILENAME,Or as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,a as DOMAIN_DEPLOY_DEFAULT_PHASE,HE as DeployModeSchema,cr as DevSubstrateParamsSchema,sr as DevSubstrateSynthPropsSchema,QE as EXPECTED_CH_SCHEMA_VERSION_ENV,jE as EXPECTED_SCHEMA_VERSION_ENV,zE as EXPECTED_SCHEMA_VERSION_TOOL_ENV,ce as GOVERNANCE_ACCOUNT_TIERS,ze as GOVERNANCE_SCOPE_REQUIRED_CODE,vE as IMAGE_TAG_PATTERN,yE as ImageTagSchema,ke as MACHINE_ONLY_SCOPES,Ee as MASKED_VALUE_MARKER,ve as MAX_SECONDARY_REGIONS,kE as MIGRATION_SNAPSHOT_NAME_PREFIX,ar as OPENNEXT_PATTERN_TYPES,ye as OPT_IN_REGION_CODES,_r as PATTERN_REGISTRY,tr as PATTERN_TYPES,rr as PATTERN_TYPE_VALUES,er as PHYSICAL_NAME_FALLBACK_PROPERTIES,wE as PRISMA_MIGRATION_DIR_RE,oe as REDACTED_KEY_SENTINEL,X as REGION_SHORT_CODES,dE as RESERVED_APP_NAMES,xE as RESERVED_APP_NAME_MESSAGE,UE as RESERVED_APP_NAME_SUFFIX,uE as RESERVED_APP_NAME_SUFFIX_MESSAGE,xe as RESOURCE_CATEGORIES,qE as SCHEMA_ADMIN_PASSWORD_ENV,ZE as SCHEMA_ADMIN_USER_ENV,_e as SCOPED_TOKEN_REGEX,We as SCOPE_VALUES,qe as SECRET_NAME_ERROR,Ze as SECRET_NAME_PATTERN,Je as SSM_COMPONENT_ERROR,we as SSM_COMPONENT_PATTERN,$e as SSM_STANDARD_MAX_VALUE_BYTES,Tr as STATIC_SITE_ROUTING_VALUES,ne as STRUCTURAL_ENVIRONMENTS,eE as SecretNamespaceSchema,XE as ServiceArtefactSchema,KE as ServiceArtefactsSchema,n as TOKEN_STDERR_PREFIX,je as USER_GRANTABLE_SCOPES,he as abbreviateRegion,f as accountConstructKey,De as accountTier,BE as artefactOutputKey,sE as buildAppConfigPath,EE as buildNamespaceParts,rE as buildParameterPath,p as capitalise,Le as categoriseResource,v as defaultConnectedAccountName,Nr as defaultFormsCorsOrigin,nr as defaultFormsFromAddress,NE as deriveAllTargets,GE as deriveContentHashTag,iE as deriveRegionsFromOrgConfig,nE as deriveTargets,CE as environmentOrTier,Ie as environmentToTier,AE as escapeDotEnvValue,ee as filterDangerousEnvVars,Y as findAccountNameCollision,IE as findBoundaryPath,pE as findInfrastructurePaths,mE as findTarget,K as findTrailingRegionShortCode,Z as formatErrorString,OE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,ge as getEnvironmentLabel,z as getErrorCode,k as getErrorMessage,Q as getErrorStack,Ue as getExpectedDuration,ue as getFriendlyResourceType,He as getRegionInfo,I as getSafeZoneName,D as hasAsciiStableConstructKey,j as hasErrorCode,VE as hasReservedAppNameSuffix,C as imageTagParameterName,gE as inferContainerFromCandidates,me as isAccountStage,se as isAccountTier,Cr as isAddressAtDomain,pe as isGovernanceTier,fE as isInfrastructureFile,oE as isManageablePath,A as isManagedDomainBinding,Sr as isOpenNextPatternType,or as isPatternType,LE as isReservedAppName,Te as mapSettledWithConcurrency,re as maskSensitiveOutput,W as normaliseError,Xe as optInRegionWarning,_E as parseDotEnv,le as parseGitRemoteUrl,tE as parseParameterPath,te as parseShellArgs,h as projectCapacityIdentityToTarget,b as regionSuffixRejectionMessage,Ke as regions,w as singleton,ae as sleep,fe as stageFromWireEnvironment,y as suffixedAccountName,be as suggestRegionForTimezone,P as toKebab,O as toPascalCase,c as toScreamingSnake,s as toValidDatabaseName};

package/dist/securityHelpers.d.ts

@@ -31,6 +31,19 @@ export declare function filterDangerousEnvVars(env: Record<string, string | unde
  * The global form lives in `SCOPED_TOKEN_GLOBAL_REGEX` below for the iteration site.
  */
 export declare const SCOPED_TOKEN_REGEX: RegExp;
+/**
+ * Marker embedded in every maskSensitiveOutput replacement except the PEM
+ * branch (which uses REDACTED_KEY_SENTINEL). Exported so display surfaces
+ * that detect masked values (e.g. the webapp changeset preview) import the
+ * marker rather than re-declaring the literal.
+ */
+export declare const MASKED_VALUE_MARKER = "***";
+/**
+ * Sentinel embedded in the PEM-branch replacement
+ * (`-----BEGIN [REDACTED] PRIVATE KEY-----`). Exported for the same
+ * detection consumers as MASKED_VALUE_MARKER.
+ */
+export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
 /**
  * Mask sensitive information in output strings to prevent credential leakage.
  * Patterns: postgres://user:pass@host, password=xxx, secret=xxx, apikey=xxx,

package/dist/securityHelpers.js

@@ -1 +1 @@
-var c=Object.defineProperty;var n=(e,s)=>c(e,"name",{value:s,configurable:!0});const i=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function D(e){return Object.fromEntries(Object.entries(e).filter(([s])=>!i.has(s.toUpperCase())))}n(D,"filterDangerousEnvVars");const R=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,l=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g;function T(e){return e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,"-----BEGIN [REDACTED] PRIVATE KEY-----...-----END [REDACTED] PRIVATE KEY-----").replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,"-----BEGIN [REDACTED] PRIVATE KEY-----...-----END [REDACTED] PRIVATE KEY-----").replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,"$1***$2").replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,"$1$2***").replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,"$1***").replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,"$1_$2_***").replace(/\bwhsec_[A-Za-z0-9]{8,}/g,"whsec_***").replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,"***").replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,"$1***").replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,"***").replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,"***").replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,"***").replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,"***").replace(l,"$1***")}n(T,"maskSensitiveOutput");function p(e){const s=[];let E="",a=!1,t=!1,A=!1,_=!1;for(const r of e){if(A){E+=r,A=!1;continue}if(r==="\\"&&!a){A=!0;continue}if(r==="'"&&!t){a=!a,_=!0;continue}if(r==='"'&&!a){t=!t,_=!0;continue}if(r===" "&&!a&&!t){(E||_)&&(s.push(E),E="",_=!1);continue}E+=r}if(a||t)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${e.slice(0,80)}`);if(A)throw new Error(`Trailing backslash in command: ${e.slice(0,80)}`);return(E||_)&&s.push(E),s}n(p,"parseShellArgs");export{i as DANGEROUS_ENV_VARS,R as SCOPED_TOKEN_REGEX,D as filterDangerousEnvVars,T as maskSensitiveOutput,p as parseShellArgs};
+var l=Object.defineProperty;var A=(E,s)=>l(E,"name",{value:s,configurable:!0});const D=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function T(E){return Object.fromEntries(Object.entries(E).filter(([s])=>!D.has(s.toUpperCase())))}A(T,"filterDangerousEnvVars");const u=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,R=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,_="***",o="[REDACTED]",i=`-----BEGIN ${o} PRIVATE KEY-----...-----END ${o} PRIVATE KEY-----`;function N(E){return E.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>i).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>i).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(s,e,t)=>`${e}${_}${t}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(s,e,t)=>`${e}${t}${_}`).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(s,e)=>`${e}${_}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(s,e,t)=>`${e}_${t}_${_}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${_}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,_).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(s,e)=>`${e}${_}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,_).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,_).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,_).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,_).replace(R,(s,e)=>`${e}${_}`)}A(N,"maskSensitiveOutput");function I(E){const s=[];let e="",t=!1,r=!1,n=!1,c=!1;for(const a of E){if(n){e+=a,n=!1;continue}if(a==="\\"&&!t){n=!0;continue}if(a==="'"&&!r){t=!t,c=!0;continue}if(a==='"'&&!t){r=!r,c=!0;continue}if(a===" "&&!t&&!r){(e||c)&&(s.push(e),e="",c=!1);continue}e+=a}if(t||r)throw new Error(`Unbalanced ${t?"single":"double"} quote in command: ${E.slice(0,80)}`);if(n)throw new Error(`Trailing backslash in command: ${E.slice(0,80)}`);return(e||c)&&s.push(e),s}A(I,"parseShellArgs");export{D as DANGEROUS_ENV_VARS,_ as MASKED_VALUE_MARKER,o as REDACTED_KEY_SENTINEL,u as SCOPED_TOKEN_REGEX,T as filterDangerousEnvVars,N as maskSensitiveOutput,I as parseShellArgs};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "7.2.0",
+  "version": "7.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",