@fjall/util 7.2.0 → 8.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "dbfc9fe91717c8e62437d979ef93c5e47ec43c9e2bfaf9cd239f6ff8d05de506",
+  "hash": "44f9288c9bafa6baf6a191987515c94196c3e7b7d96fa9ed9c97d2b6d49044c5",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
@@ -56,11 +56,11 @@
     "src/docker/rawjsonParser.ts": "b9e5218abc326fa5",
     "src/docker/rawjsonToVertexEvent.ts": "a356190727f0d1a4",
     "src/docker/result.ts": "2ff0d59a3add8b06",
-    "src/environments.ts": "13d583ce2ce37454",
+    "src/environments.ts": "b3d2f2493554cd0f",
     "src/errorUtils.ts": "c601f2905c74b8d0",
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
-    "src/index.ts": "80f518c9eb6f13e6",
+    "src/index.ts": "79929947a329af6f",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "125c099da0e17ac1",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
@@ -86,6 +86,7 @@
     "src/naming/caseConversion.ts": "8b8984f2b58b8ab7",
     "src/naming/connectedAccountName.ts": "3cd3bc7dba0a2f0b",
     "src/naming/reservedAppNames.ts": "7f63dd0b84c1972e",
+    "src/naming/targetExportNames.ts": "82447463310e43c8",
     "src/patterns/index.ts": "6e8b1b7a4a7db24c",
     "src/patterns/patternTypes.ts": "c64758645bc88702",
     "src/patterns/staticSiteForms.ts": "86ffcf142d9a8eac",
@@ -99,12 +100,12 @@
     "src/repo/scanTypes.ts": "1fda805a7d8de93b",
     "src/resourceCategorisation.ts": "a140d1b3cb38be33",
     "src/secrets.ts": "50258d463e4e67c3",
-    "src/securityHelpers.ts": "acbf209255468ff4",
+    "src/securityHelpers.ts": "ee2ab9ffd53119fb",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "59b911cb627059ca",
+    "package.json": "4c2a38493de54289",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "89286d0f2d794900630136797d4bbcbbfbf2a17a288efbd121621ea0f3b6ac47",
-  "outputFileCount": 187
+  "outputHash": "5d99d7488716ca9206bb2dab110e4230414d66429c6d03cb3787c27e51ca8e26",
+  "outputFileCount": 189
 }

package/dist/.minified

@@ -1 +1 @@
-93 files minified at 2026-08-06T02:33:46.620Z
+94 files minified at 2026-08-09T06:27:36.179Z

package/dist/environments.d.ts

@@ -112,3 +112,25 @@ export declare function accountTier(acc: {
     tier?: AccountTier | null;
     environment?: string | null;
 }): AccountTier;
+/**
+ * Resolve a provider account's synth-time environment — the value that reaches
+ * a CDK synth as `-c environment=` and that `envAwareRemovalPolicyDefault()`
+ * turns into RETAIN or DESTROY.
+ *
+ * The tier/stage separation (decisions/2026-06-07-account-tier-vs-stage-separation.md)
+ * nulls the wire `environment` for organisation-tier accounts, but scaffolded
+ * org entry points gate on `config.environment === "root"` — decode the tier
+ * back to the historical "root" marker via the sanctioned `accountTier()`
+ * decoder. Workload stages pass through verbatim; a null stage on any other
+ * tier stays unresolved.
+ *
+ * Lives here, not in the constructs package, because deploy-core resolves the
+ * environment BEFORE synth (to pass it explicitly) while
+ * `components/infrastructure` resolves it DURING synth (when no explicit
+ * signal arrived). Two derivations that disagree would put a stack's removal
+ * policies on the wrong side of production — so there is only one.
+ */
+export declare function resolveSynthEnvironment(acc: {
+    tier?: AccountTier | null;
+    environment?: string | null;
+}): string | undefined;

package/dist/environments.js

@@ -1 +1 @@
-var O=Object.defineProperty;var o=(t,i)=>O(t,"name",{value:i,configurable:!0});import{z as u}from"zod";const e=["production","staging","development","platform","compliance"],a={production:"Production",staging:"Staging",development:"Development",platform:"Platform",compliance:"Compliance"},p=new Set(e);function T(t){return p.has(t)}o(T,"isAccountStage");const r={ROOT:"root",PLATFORM:"platform"},l=[...e,r.ROOT];function f(t){return T(t)?a[t]:t.charAt(0).toUpperCase()+t.slice(1)}o(f,"getEnvironmentLabel");const c=["organisation","platform","account"],_=u.enum(c),n={ORGANISATION:"organisation",PLATFORM:"platform",ACCOUNT:"account"},A={[n.ORGANISATION]:!0,[n.PLATFORM]:!0,[n.ACCOUNT]:!0},C=new Set(Object.keys(A));function m(t){return C.has(t)}o(m,"isAccountTier");const s=c.filter(t=>t!==n.ACCOUNT),E=new Set(s);function x(t){return E.has(t)}o(x,"isGovernanceTier");function N(t){return t===r.ROOT?"organisation":t===r.PLATFORM?"platform":"account"}o(N,"environmentToTier");function U(t){return t==null||t===""||t===r.ROOT?null:T(t)?t:null}o(U,"stageFromWireEnvironment");function g(t){return t.tier??N(t.environment)}o(g,"accountTier");export{n as ACCOUNT_ROLES,e as ACCOUNT_STAGES,l as ACCOUNT_STAGES_WITH_ROOT,a as ACCOUNT_STAGE_LABELS,c as ACCOUNT_TIERS,_ as AccountTierSchema,s as GOVERNANCE_ACCOUNT_TIERS,r as STRUCTURAL_ENVIRONMENTS,g as accountTier,N as environmentToTier,f as getEnvironmentLabel,T as isAccountStage,m as isAccountTier,x as isGovernanceTier,U as stageFromWireEnvironment};
+var u=Object.defineProperty;var n=(t,c)=>u(t,"name",{value:c,configurable:!0});import{z as O}from"zod";const e=["production","staging","development","platform","compliance"],a={production:"Production",staging:"Staging",development:"Development",platform:"Platform",compliance:"Compliance"},p=new Set(e);function T(t){return p.has(t)}n(T,"isAccountStage");const o={ROOT:"root",PLATFORM:"platform"},l=[...e,o.ROOT];function _(t){return T(t)?a[t]:t.charAt(0).toUpperCase()+t.slice(1)}n(_,"getEnvironmentLabel");const i=["organisation","platform","account"],m=O.enum(i),r={ORGANISATION:"organisation",PLATFORM:"platform",ACCOUNT:"account"},A={[r.ORGANISATION]:!0,[r.PLATFORM]:!0,[r.ACCOUNT]:!0},C=new Set(Object.keys(A));function x(t){return C.has(t)}n(x,"isAccountTier");const s=i.filter(t=>t!==r.ACCOUNT),E=new Set(s);function U(t){return E.has(t)}n(U,"isGovernanceTier");function R(t){return t===o.ROOT?"organisation":t===o.PLATFORM?"platform":"account"}n(R,"environmentToTier");function g(t){return t==null||t===""||t===o.ROOT?null:T(t)?t:null}n(g,"stageFromWireEnvironment");function S(t){return t.tier??R(t.environment)}n(S,"accountTier");function I(t){return S(t)==="organisation"?o.ROOT:t.environment??void 0}n(I,"resolveSynthEnvironment");export{r as ACCOUNT_ROLES,e as ACCOUNT_STAGES,l as ACCOUNT_STAGES_WITH_ROOT,a as ACCOUNT_STAGE_LABELS,i as ACCOUNT_TIERS,m as AccountTierSchema,s as GOVERNANCE_ACCOUNT_TIERS,o as STRUCTURAL_ENVIRONMENTS,S as accountTier,R as environmentToTier,_ as getEnvironmentLabel,T as isAccountStage,x as isAccountTier,U as isGovernanceTier,I as resolveSynthEnvironment,g as stageFromWireEnvironment};

package/dist/index.d.ts

@@ -3,15 +3,16 @@ export { BACKUP_VAULT_NAME } from "./infra/backupVault.js";
 export { APPROVAL_TOKEN_OUTPUT_PREFIX, TOKEN_STDERR_PREFIX } from "./deploy/approvalTokenOutput.js";
 export { imageTagParameterName } from "./infra/imageTags.js";
 export { toPascalCase, toKebab, toValidDatabaseName, toScreamingSnake, capitalise, getSafeZoneName, accountConstructKey, hasAsciiStableConstructKey } from "./naming/caseConversion.js";
+export { albDnsExportName, albHostedZoneIdExportName, cdnDomainExportName, bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "./naming/targetExportNames.js";
 export { CAPACITY_SLOT_PATTERN, CAPACITY_SLOT_MAX_LENGTH, DEFAULT_CAPACITY_SLOT, CAPACITY_ANCHOR_PATTERN, CAPACITY_ANCHOR_MAX_LENGTH, CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityPinSchema, type CapacityIdentityPin, CapacityIdentityWireSchema, type CapacityIdentityWire, CapacityIdentityConfigSchema, type CapacityIdentityConfig, projectCapacityIdentityToTarget } from "./capacityIdentity.js";
 export { findAccountNameCollision, type AccountNameCollision } from "./naming/accountNameCollision.js";
 export { defaultConnectedAccountName, suffixedAccountName, REGION_SHORT_CODES, findTrailingRegionShortCode, regionSuffixRejectionMessage } from "./naming/connectedAccountName.js";
 export { normaliseError, getErrorMessage, hasErrorCode, getErrorCode, getErrorStack, formatErrorString } from "./errorUtils.js";
 export { singleton } from "./async/singleton.js";
-export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
+export { DANGEROUS_ENV_VARS, filterDangerousEnvVars, MASKED_VALUE_MARKER, maskSensitiveOutput, parseShellArgs, REDACTED_KEY_SENTINEL, SCOPED_TOKEN_REGEX } from "./securityHelpers.js";
 export { sleep } from "./async/sleep.js";
 export { mapSettledWithConcurrency } from "./async/concurrency.js";
-export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, stageFromWireEnvironment, accountTier, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
+export { ACCOUNT_STAGES_WITH_ROOT, STRUCTURAL_ENVIRONMENTS, ACCOUNT_STAGES, ACCOUNT_STAGE_LABELS, isAccountStage, ACCOUNT_TIERS, type AccountTier, AccountTierSchema, isAccountTier, GOVERNANCE_ACCOUNT_TIERS, isGovernanceTier, environmentToTier, stageFromWireEnvironment, accountTier, resolveSynthEnvironment, type AccountStageWithRoot, type AccountStage, getEnvironmentLabel, ACCOUNT_ROLES } from "./environments.js";
 export { RESOURCE_CATEGORIES, type ResourceCategory, categoriseResource, getExpectedDuration, getFriendlyResourceType } from "./resourceCategorisation.js";
 export { parseGitRemoteUrl, type GitProvider, type ParsedGitRemote } from "./repo/gitRemoteParser.js";
 export { abbreviateRegion, AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, MAX_SECONDARY_REGIONS, OPT_IN_REGION_CODES, optInRegionWarning, regions, suggestRegionForTimezone, type RegionCode, type RegionInfo } from "./infra/regions.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as E,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as R,TOKEN_STDERR_PREFIX as n}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as C}from"./infra/imageTags.js";import{toPascalCase as O,toKebab as P,toValidDatabaseName as s,toScreamingSnake as c,capitalise as p,getSafeZoneName as I,accountConstructKey as f,hasAsciiStableConstructKey as g}from"./naming/caseConversion.js";import{CAPACITY_SLOT_PATTERN as M,CAPACITY_SLOT_MAX_LENGTH as d,DEFAULT_CAPACITY_SLOT as x,CAPACITY_ANCHOR_PATTERN as u,CAPACITY_ANCHOR_MAX_LENGTH as U,CAPACITY_IDENTITY_CONTEXT_KEY as L,CapacityIdentityPinSchema as V,CapacityIdentityWireSchema as l,CapacityIdentityConfigSchema as G,projectCapacityIdentityToTarget as h}from"./capacityIdentity.js";import{findAccountNameCollision as H}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as v,suffixedAccountName as y,REGION_SHORT_CODES as X,findTrailingRegionShortCode as b,regionSuffixRejectionMessage as K}from"./naming/connectedAccountName.js";import{normaliseError as W,getErrorMessage as k,hasErrorCode as j,getErrorCode as z,getErrorStack as Q,formatErrorString as Z}from"./errorUtils.js";import{singleton as w}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as $,filterDangerousEnvVars as ee,maskSensitiveOutput as re,parseShellArgs as Ee,SCOPED_TOKEN_REGEX as te}from"./securityHelpers.js";import{sleep as _e}from"./async/sleep.js";import{mapSettledWithConcurrency as Ae}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Te,STRUCTURAL_ENVIRONMENTS as ie,ACCOUNT_STAGES as Re,ACCOUNT_STAGE_LABELS as ne,isAccountStage as Ne,ACCOUNT_TIERS as Ce,AccountTierSchema as me,isAccountTier as Oe,GOVERNANCE_ACCOUNT_TIERS as Pe,isGovernanceTier as se,environmentToTier as ce,stageFromWireEnvironment as pe,accountTier as Ie,getEnvironmentLabel as fe,ACCOUNT_ROLES as ge}from"./environments.js";import{RESOURCE_CATEGORIES as Me,categoriseResource as de,getExpectedDuration as xe,getFriendlyResourceType as ue}from"./resourceCategorisation.js";import{parseGitRemoteUrl as Le}from"./repo/gitRemoteParser.js";import{abbreviateRegion as le,AWS_REGIONS_METADATA as Ge,DEFAULT_REGION as he,getRegionInfo as Fe,MAX_SECONDARY_REGIONS as He,OPT_IN_REGION_CODES as Ye,optInRegionWarning as ve,regions as ye,suggestRegionForTimezone as Xe}from"./infra/regions.js";import{SCOPE_VALUES as Ke,MACHINE_ONLY_SCOPES as Be,USER_GRANTABLE_SCOPES as We,GOVERNANCE_SCOPE_REQUIRED_CODE as ke}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as ze,SECRET_NAME_ERROR as Qe,SSM_COMPONENT_PATTERN as Ze,SSM_COMPONENT_ERROR as qe,SSM_STANDARD_MAX_VALUE_BYTES as we,SecretNamespaceSchema as Je,buildNamespaceParts as $e,buildParameterPath as er,parseParameterPath as rr,isManageablePath as Er,parseDotEnv as tr,escapeDotEnvValue as or}from"./secrets.js";import{ConnectionWireSchema as ar,ConnectionsListResponseSchema as Ar}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as Tr,deriveTargets as ir,deriveAllTargets as Rr,environmentOrTier as nr,findTarget as Nr,generateTargetName as Cr}from"./targets.js";import{buildAppConfigPath as Or}from"./repo/appPath.js";import{findInfrastructurePaths as sr,findBoundaryPath as cr,isInfrastructureFile as pr}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as fr}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as Dr,RESERVED_APP_NAME_MESSAGE as Mr,isReservedAppName as dr,RESERVED_APP_NAME_SUFFIX as xr,RESERVED_APP_NAME_SUFFIX_MESSAGE as ur,hasReservedAppNameSuffix as Ur}from"./naming/reservedAppNames.js";import{deriveContentHashTag as Vr,CONTENT_HASH_TAG_PATTERN as lr}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as hr,DeployModeSchema as Fr,IMAGE_TAG_PATTERN as Hr,ImageTagSchema as Yr,ServiceArtefactSchema as vr,ServiceArtefactsSchema as yr,ARTEFACT_OUTPUT_FIELDS as Xr,artefactOutputKey as br}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as Br,EXPECTED_SCHEMA_VERSION_ENV as Wr,EXPECTED_SCHEMA_VERSION_TOOL_ENV as kr,EXPECTED_CH_SCHEMA_VERSION_ENV as jr,SCHEMA_ADMIN_USER_ENV as zr,SCHEMA_ADMIN_PASSWORD_ENV as Qr,PRISMA_MIGRATION_DIR_RE as Zr,CLICKHOUSE_MIGRATION_SKIP_RE as qr}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Jr}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as eE,PATTERN_TYPES as rE,isPatternType as EE,PATTERN_REGISTRY as tE,DEPLOYABLE_PATTERN_TYPES as oE,OPENNEXT_PATTERN_TYPES as _E,isOpenNextPatternType as aE,STATIC_SITE_ROUTING_VALUES as AE}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as TE,defaultFormsFromAddress as iE,defaultFormsCorsOrigin as RE,isAddressAtDomain as nE}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as CE,DEV_SUBSTRATE_PARAMS_FILENAME as mE,DevSubstrateSynthPropsSchema as OE,DevSubstrateParamsSchema as PE}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as cE}from"./devSubstrate/entrypoint.js";export{ge as ACCOUNT_ROLES,Re as ACCOUNT_STAGES,Te as ACCOUNT_STAGES_WITH_ROOT,ne as ACCOUNT_STAGE_LABELS,Ce as ACCOUNT_TIERS,R as APPROVAL_TOKEN_OUTPUT_PREFIX,Xr as ARTEFACT_OUTPUT_FIELDS,Ge as AWS_REGIONS_METADATA,me as AccountTierSchema,T as BACKUP_VAULT_NAME,U as CAPACITY_ANCHOR_MAX_LENGTH,u as CAPACITY_ANCHOR_PATTERN,L as CAPACITY_IDENTITY_CONTEXT_KEY,d as CAPACITY_SLOT_MAX_LENGTH,M as CAPACITY_SLOT_PATTERN,qr as CLICKHOUSE_MIGRATION_SKIP_RE,lr as CONTENT_HASH_TAG_PATTERN,G as CapacityIdentityConfigSchema,V as CapacityIdentityPinSchema,l as CapacityIdentityWireSchema,ar as ConnectionWireSchema,Ar as ConnectionsListResponseSchema,$ as DANGEROUS_ENV_VARS,x as DEFAULT_CAPACITY_SLOT,TE as DEFAULT_FORMS_FROM_LOCAL_PART,he as DEFAULT_REGION,oE as DEPLOYABLE_PATTERN_TYPES,hr as DEPLOY_MODES,cE as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,mE as DEV_SUBSTRATE_PARAMS_FILENAME,CE as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,E as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,Fr as DeployModeSchema,PE as DevSubstrateParamsSchema,OE as DevSubstrateSynthPropsSchema,jr as EXPECTED_CH_SCHEMA_VERSION_ENV,Wr as EXPECTED_SCHEMA_VERSION_ENV,kr as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Pe as GOVERNANCE_ACCOUNT_TIERS,ke as GOVERNANCE_SCOPE_REQUIRED_CODE,Hr as IMAGE_TAG_PATTERN,Yr as ImageTagSchema,Be as MACHINE_ONLY_SCOPES,He as MAX_SECONDARY_REGIONS,Br as MIGRATION_SNAPSHOT_NAME_PREFIX,_E as OPENNEXT_PATTERN_TYPES,Ye as OPT_IN_REGION_CODES,tE as PATTERN_REGISTRY,rE as PATTERN_TYPES,eE as PATTERN_TYPE_VALUES,Jr as PHYSICAL_NAME_FALLBACK_PROPERTIES,Zr as PRISMA_MIGRATION_DIR_RE,X as REGION_SHORT_CODES,Dr as RESERVED_APP_NAMES,Mr as RESERVED_APP_NAME_MESSAGE,xr as RESERVED_APP_NAME_SUFFIX,ur as RESERVED_APP_NAME_SUFFIX_MESSAGE,Me as RESOURCE_CATEGORIES,Qr as SCHEMA_ADMIN_PASSWORD_ENV,zr as SCHEMA_ADMIN_USER_ENV,te as SCOPED_TOKEN_REGEX,Ke as SCOPE_VALUES,Qe as SECRET_NAME_ERROR,ze as SECRET_NAME_PATTERN,qe as SSM_COMPONENT_ERROR,Ze as SSM_COMPONENT_PATTERN,we as SSM_STANDARD_MAX_VALUE_BYTES,AE as STATIC_SITE_ROUTING_VALUES,ie as STRUCTURAL_ENVIRONMENTS,Je as SecretNamespaceSchema,vr as ServiceArtefactSchema,yr as ServiceArtefactsSchema,n as TOKEN_STDERR_PREFIX,We as USER_GRANTABLE_SCOPES,le as abbreviateRegion,f as accountConstructKey,Ie as accountTier,br as artefactOutputKey,Or as buildAppConfigPath,$e as buildNamespaceParts,er as buildParameterPath,p as capitalise,de as categoriseResource,v as defaultConnectedAccountName,RE as defaultFormsCorsOrigin,iE as defaultFormsFromAddress,Rr as deriveAllTargets,Vr as deriveContentHashTag,Tr as deriveRegionsFromOrgConfig,ir as deriveTargets,nr as environmentOrTier,ce as environmentToTier,or as escapeDotEnvValue,ee as filterDangerousEnvVars,H as findAccountNameCollision,cr as findBoundaryPath,sr as findInfrastructurePaths,Nr as findTarget,b as findTrailingRegionShortCode,Z as formatErrorString,Cr as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,fe as getEnvironmentLabel,z as getErrorCode,k as getErrorMessage,Q as getErrorStack,xe as getExpectedDuration,ue as getFriendlyResourceType,Fe as getRegionInfo,I as getSafeZoneName,g as hasAsciiStableConstructKey,j as hasErrorCode,Ur as hasReservedAppNameSuffix,C as imageTagParameterName,fr as inferContainerFromCandidates,Ne as isAccountStage,Oe as isAccountTier,nE as isAddressAtDomain,se as isGovernanceTier,pr as isInfrastructureFile,Er as isManageablePath,a as isManagedDomainBinding,aE as isOpenNextPatternType,EE as isPatternType,dr as isReservedAppName,Ae as mapSettledWithConcurrency,re as maskSensitiveOutput,W as normaliseError,ve as optInRegionWarning,tr as parseDotEnv,Le as parseGitRemoteUrl,rr as parseParameterPath,Ee as parseShellArgs,h as projectCapacityIdentityToTarget,K as regionSuffixRejectionMessage,ye as regions,w as singleton,_e as sleep,pe as stageFromWireEnvironment,y as suffixedAccountName,Xe as suggestRegionForTimezone,P as toKebab,O as toPascalCase,c as toScreamingSnake,s as toValidDatabaseName};
+import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as R}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as s,toKebab as O,toValidDatabaseName as P,toScreamingSnake as p,capitalise as c,getSafeZoneName as I,accountConstructKey as f,hasAsciiStableConstructKey as D}from"./naming/caseConversion.js";import{albDnsExportName as M,albHostedZoneIdExportName as d,cdnDomainExportName as x,bucketWebsiteEndpointExportName as u,bucketWebsiteHostedZoneIdExportName as L}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as l,CAPACITY_SLOT_MAX_LENGTH as V,DEFAULT_CAPACITY_SLOT as h,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as F,CAPACITY_IDENTITY_CONTEXT_KEY as H,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as Y,CapacityIdentityConfigSchema as y,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as K}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as W,suffixedAccountName as k,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as j,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as q,getErrorMessage as w,hasErrorCode as J,getErrorCode as $,getErrorStack as ee,formatErrorString as Ee}from"./errorUtils.js";import{singleton as te}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as _e,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ae,maskSensitiveOutput as Se,parseShellArgs as Te,REDACTED_KEY_SENTINEL as ne,SCOPED_TOKEN_REGEX as ie}from"./securityHelpers.js";import{sleep as Ne}from"./async/sleep.js";import{mapSettledWithConcurrency as Ce}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Oe,STRUCTURAL_ENVIRONMENTS as Pe,ACCOUNT_STAGES as pe,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Ie,ACCOUNT_TIERS as fe,AccountTierSchema as De,isAccountTier as ge,GOVERNANCE_ACCOUNT_TIERS as Me,isGovernanceTier as de,environmentToTier as xe,stageFromWireEnvironment as ue,accountTier as Le,resolveSynthEnvironment as Ue,getEnvironmentLabel as le,ACCOUNT_ROLES as Ve}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as Fe,getExpectedDuration as He,getFriendlyResourceType as ve}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ye}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Xe,AWS_REGIONS_METADATA as Ke,DEFAULT_REGION as Be,getRegionInfo as We,MAX_SECONDARY_REGIONS as ke,OPT_IN_REGION_CODES as Ze,optInRegionWarning as je,regions as ze,suggestRegionForTimezone as Qe}from"./infra/regions.js";import{SCOPE_VALUES as we,MACHINE_ONLY_SCOPES as Je,USER_GRANTABLE_SCOPES as $e,GOVERNANCE_SCOPE_REQUIRED_CODE as eE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as rE,SECRET_NAME_ERROR as tE,SSM_COMPONENT_PATTERN as oE,SSM_COMPONENT_ERROR as _E,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as AE,buildNamespaceParts as SE,buildParameterPath as TE,parseParameterPath as nE,isManageablePath as iE,parseDotEnv as RE,escapeDotEnvValue as NE}from"./secrets.js";import{ConnectionWireSchema as CE,ConnectionsListResponseSchema as sE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as PE,deriveTargets as pE,deriveAllTargets as cE,environmentOrTier as IE,findTarget as fE,generateTargetName as DE}from"./targets.js";import{buildAppConfigPath as ME}from"./repo/appPath.js";import{findInfrastructurePaths as xE,findBoundaryPath as uE,isInfrastructureFile as LE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as lE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as hE,RESERVED_APP_NAME_MESSAGE as GE,isReservedAppName as FE,RESERVED_APP_NAME_SUFFIX as HE,RESERVED_APP_NAME_SUFFIX_MESSAGE as vE,hasReservedAppNameSuffix as YE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as bE,CONTENT_HASH_TAG_PATTERN as XE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as BE,DeployModeSchema as WE,IMAGE_TAG_PATTERN as kE,ImageTagSchema as ZE,ServiceArtefactSchema as jE,ServiceArtefactsSchema as zE,ARTEFACT_OUTPUT_FIELDS as QE,artefactOutputKey as qE}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as JE,EXPECTED_SCHEMA_VERSION_ENV as $E,EXPECTED_SCHEMA_VERSION_TOOL_ENV as er,EXPECTED_CH_SCHEMA_VERSION_ENV as Er,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as tr,PRISMA_MIGRATION_DIR_RE as or,CLICKHOUSE_MIGRATION_SKIP_RE as _r}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Ar}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Tr,PATTERN_TYPES as nr,isPatternType as ir,PATTERN_REGISTRY as Rr,DEPLOYABLE_PATTERN_TYPES as Nr,OPENNEXT_PATTERN_TYPES as mr,isOpenNextPatternType as Cr,STATIC_SITE_ROUTING_VALUES as sr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Pr,defaultFormsFromAddress as pr,defaultFormsCorsOrigin as cr,isAddressAtDomain as Ir}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Dr,DEV_SUBSTRATE_PARAMS_FILENAME as gr,DevSubstrateSynthPropsSchema as Mr,DevSubstrateParamsSchema as dr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as ur}from"./devSubstrate/entrypoint.js";export{Ve as ACCOUNT_ROLES,pe as ACCOUNT_STAGES,Oe as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,fe as ACCOUNT_TIERS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,QE as ARTEFACT_OUTPUT_FIELDS,Ke as AWS_REGIONS_METADATA,De as AccountTierSchema,T as BACKUP_VAULT_NAME,F as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,H as CAPACITY_IDENTITY_CONTEXT_KEY,V as CAPACITY_SLOT_MAX_LENGTH,l as CAPACITY_SLOT_PATTERN,_r as CLICKHOUSE_MIGRATION_SKIP_RE,XE as CONTENT_HASH_TAG_PATTERN,y as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,Y as CapacityIdentityWireSchema,CE as ConnectionWireSchema,sE as ConnectionsListResponseSchema,_e as DANGEROUS_ENV_VARS,h as DEFAULT_CAPACITY_SLOT,Pr as DEFAULT_FORMS_FROM_LOCAL_PART,Be as DEFAULT_REGION,Nr as DEPLOYABLE_PATTERN_TYPES,BE as DEPLOY_MODES,ur as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,gr as DEV_SUBSTRATE_PARAMS_FILENAME,Dr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,WE as DeployModeSchema,dr as DevSubstrateParamsSchema,Mr as DevSubstrateSynthPropsSchema,Er as EXPECTED_CH_SCHEMA_VERSION_ENV,$E as EXPECTED_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Me as GOVERNANCE_ACCOUNT_TIERS,eE as GOVERNANCE_SCOPE_REQUIRED_CODE,kE as IMAGE_TAG_PATTERN,ZE as ImageTagSchema,Je as MACHINE_ONLY_SCOPES,Ae as MASKED_VALUE_MARKER,ke as MAX_SECONDARY_REGIONS,JE as MIGRATION_SNAPSHOT_NAME_PREFIX,mr as OPENNEXT_PATTERN_TYPES,Ze as OPT_IN_REGION_CODES,Rr as PATTERN_REGISTRY,nr as PATTERN_TYPES,Tr as PATTERN_TYPE_VALUES,Ar as PHYSICAL_NAME_FALLBACK_PROPERTIES,or as PRISMA_MIGRATION_DIR_RE,ne as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,hE as RESERVED_APP_NAMES,GE as RESERVED_APP_NAME_MESSAGE,HE as RESERVED_APP_NAME_SUFFIX,vE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,ie as SCOPED_TOKEN_REGEX,we as SCOPE_VALUES,tE as SECRET_NAME_ERROR,rE as SECRET_NAME_PATTERN,_E as SSM_COMPONENT_ERROR,oE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,sr as STATIC_SITE_ROUTING_VALUES,Pe as STRUCTURAL_ENVIRONMENTS,AE as SecretNamespaceSchema,jE as ServiceArtefactSchema,zE as ServiceArtefactsSchema,R as TOKEN_STDERR_PREFIX,$e as USER_GRANTABLE_SCOPES,Xe as abbreviateRegion,f as accountConstructKey,Le as accountTier,M as albDnsExportName,d as albHostedZoneIdExportName,qE as artefactOutputKey,u as bucketWebsiteEndpointExportName,L as bucketWebsiteHostedZoneIdExportName,ME as buildAppConfigPath,SE as buildNamespaceParts,TE as buildParameterPath,c as capitalise,Fe as categoriseResource,x as cdnDomainExportName,W as defaultConnectedAccountName,cr as defaultFormsCorsOrigin,pr as defaultFormsFromAddress,cE as deriveAllTargets,bE as deriveContentHashTag,PE as deriveRegionsFromOrgConfig,pE as deriveTargets,IE as environmentOrTier,xe as environmentToTier,NE as escapeDotEnvValue,ae as filterDangerousEnvVars,K as findAccountNameCollision,uE as findBoundaryPath,xE as findInfrastructurePaths,fE as findTarget,j as findTrailingRegionShortCode,Ee as formatErrorString,DE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,le as getEnvironmentLabel,$ as getErrorCode,w as getErrorMessage,ee as getErrorStack,He as getExpectedDuration,ve as getFriendlyResourceType,We as getRegionInfo,I as getSafeZoneName,D as hasAsciiStableConstructKey,J as hasErrorCode,YE as hasReservedAppNameSuffix,m as imageTagParameterName,lE as inferContainerFromCandidates,Ie as isAccountStage,ge as isAccountTier,Ir as isAddressAtDomain,de as isGovernanceTier,LE as isInfrastructureFile,iE as isManageablePath,a as isManagedDomainBinding,Cr as isOpenNextPatternType,ir as isPatternType,FE as isReservedAppName,Ce as mapSettledWithConcurrency,Se as maskSensitiveOutput,q as normaliseError,je as optInRegionWarning,RE as parseDotEnv,ye as parseGitRemoteUrl,nE as parseParameterPath,Te as parseShellArgs,b as projectCapacityIdentityToTarget,z as regionSuffixRejectionMessage,ze as regions,Ue as resolveSynthEnvironment,te as singleton,Ne as sleep,ue as stageFromWireEnvironment,k as suffixedAccountName,Qe as suggestRegionForTimezone,O as toKebab,s as toPascalCase,p as toScreamingSnake,P as toValidDatabaseName};

package/dist/naming/targetExportNames.d.ts

@@ -0,0 +1,5 @@
+export declare function albDnsExportName(appName: string, computeName?: string): string;
+export declare function albHostedZoneIdExportName(appName: string, computeName?: string): string;
+export declare function cdnDomainExportName(appName: string): string;
+export declare function bucketWebsiteEndpointExportName(bucketName: string): string;
+export declare function bucketWebsiteHostedZoneIdExportName(bucketName: string): string;

package/dist/naming/targetExportNames.js

@@ -0,0 +1 @@
+var a=Object.defineProperty;var n=(e,t)=>a(e,"name",{value:t,configurable:!0});import{toPascalCase as p}from"./caseConversion.js";function o(e){return p(e.replace(/[^A-Za-z0-9-]/g,""))}n(o,"safeExportToken");function i(e,t){const r=o(e);return t===void 0?r:`${r}-${o(t)}-`}n(i,"albExportScope");function d(e,t){return`${i(e,t)}AlbDnsName`}n(d,"albDnsExportName");function c(e,t){return`${i(e,t)}AlbHostedZoneId`}n(c,"albHostedZoneIdExportName");function b(e){return`${o(e)}CdnDistributionDomainName`}n(b,"cdnDomainExportName");function x(e){return`${o(e)}WebsiteEndpoint`}n(x,"bucketWebsiteEndpointExportName");function f(e){return`${o(e)}WebsiteHostedZoneId`}n(f,"bucketWebsiteHostedZoneIdExportName");export{d as albDnsExportName,c as albHostedZoneIdExportName,x as bucketWebsiteEndpointExportName,f as bucketWebsiteHostedZoneIdExportName,b as cdnDomainExportName};

package/dist/securityHelpers.d.ts

@@ -31,6 +31,19 @@ export declare function filterDangerousEnvVars(env: Record<string, string | unde
  * The global form lives in `SCOPED_TOKEN_GLOBAL_REGEX` below for the iteration site.
  */
 export declare const SCOPED_TOKEN_REGEX: RegExp;
+/**
+ * Marker embedded in every maskSensitiveOutput replacement except the PEM
+ * branch (which uses REDACTED_KEY_SENTINEL). Exported so display surfaces
+ * that detect masked values (e.g. the webapp changeset preview) import the
+ * marker rather than re-declaring the literal.
+ */
+export declare const MASKED_VALUE_MARKER = "***";
+/**
+ * Sentinel embedded in the PEM-branch replacement
+ * (`-----BEGIN [REDACTED] PRIVATE KEY-----`). Exported for the same
+ * detection consumers as MASKED_VALUE_MARKER.
+ */
+export declare const REDACTED_KEY_SENTINEL = "[REDACTED]";
 /**
  * Mask sensitive information in output strings to prevent credential leakage.
  * Patterns: postgres://user:pass@host, password=xxx, secret=xxx, apikey=xxx,

package/dist/securityHelpers.js

@@ -1 +1 @@
-var c=Object.defineProperty;var n=(e,s)=>c(e,"name",{value:s,configurable:!0});const i=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function D(e){return Object.fromEntries(Object.entries(e).filter(([s])=>!i.has(s.toUpperCase())))}n(D,"filterDangerousEnvVars");const R=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,l=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g;function T(e){return e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,"-----BEGIN [REDACTED] PRIVATE KEY-----...-----END [REDACTED] PRIVATE KEY-----").replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,"-----BEGIN [REDACTED] PRIVATE KEY-----...-----END [REDACTED] PRIVATE KEY-----").replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,"$1***$2").replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,"$1$2***").replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,"$1***").replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,"$1_$2_***").replace(/\bwhsec_[A-Za-z0-9]{8,}/g,"whsec_***").replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,"***").replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,"$1***").replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,"***").replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,"***").replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,"***").replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,"***").replace(l,"$1***")}n(T,"maskSensitiveOutput");function p(e){const s=[];let E="",a=!1,t=!1,A=!1,_=!1;for(const r of e){if(A){E+=r,A=!1;continue}if(r==="\\"&&!a){A=!0;continue}if(r==="'"&&!t){a=!a,_=!0;continue}if(r==='"'&&!a){t=!t,_=!0;continue}if(r===" "&&!a&&!t){(E||_)&&(s.push(E),E="",_=!1);continue}E+=r}if(a||t)throw new Error(`Unbalanced ${a?"single":"double"} quote in command: ${e.slice(0,80)}`);if(A)throw new Error(`Trailing backslash in command: ${e.slice(0,80)}`);return(E||_)&&s.push(E),s}n(p,"parseShellArgs");export{i as DANGEROUS_ENV_VARS,R as SCOPED_TOKEN_REGEX,D as filterDangerousEnvVars,T as maskSensitiveOutput,p as parseShellArgs};
+var l=Object.defineProperty;var A=(E,s)=>l(E,"name",{value:s,configurable:!0});const D=new Set(["NODE_OPTIONS","NODE_PATH","NODE_EXTRA_CA_CERTS","NODE_DEBUG","NODE_PRESERVE_SYMLINKS","LD_PRELOAD","LD_LIBRARY_PATH","LD_AUDIT","LD_BIND_NOW","DYLD_INSERT_LIBRARIES","DYLD_LIBRARY_PATH","DYLD_FRAMEWORK_PATH","PYTHONPATH","PYTHONSTARTUP","PERL5LIB","PERL5OPT","RUBYLIB","RUBYOPT","HOME","XDG_CONFIG_HOME","AWS_SHARED_CREDENTIALS_FILE","AWS_CONFIG_FILE","SHELL","BASH_ENV","ENV","ZDOTDIR"]);function T(E){return Object.fromEntries(Object.entries(E).filter(([s])=>!D.has(s.toUpperCase())))}A(T,"filterDangerousEnvVars");const u=/fjall_(?:ak|dk)_[A-Z2-7]{16}\.[A-Z2-7]{40}/,R=/(fjall_(?:ak|dk)_)[A-Z2-7]{16}\.[A-Z2-7]{40}/g,_="***",o="[REDACTED]",i=`-----BEGIN ${o} PRIVATE KEY-----...-----END ${o} PRIVATE KEY-----`;function N(E){return E.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----(?:[^"\\]|\\[\\nrt"])*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>i).replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,()=>i).replace(/(\w+:\/\/[^:]+:)[^@]+(@)/gi,(s,e,t)=>`${e}${_}${t}`).replace(/(?<![a-zA-Z])(password|passwd|secret|api[_-]?key|token|auth|credential)([=:])["']?[^\s"']+/gi,(s,e,t)=>`${e}${t}${_}`).replace(/\b(ghu_|ghs_|ghp_|gho_|github_pat_)[A-Za-z0-9_]+/g,(s,e)=>`${e}${_}`).replace(/\b(sk|rk)_(live|test)_[A-Za-z0-9]{8,}/g,(s,e,t)=>`${e}_${t}_${_}`).replace(/\bwhsec_[A-Za-z0-9]{8,}/g,()=>`whsec_${_}`).replace(/(?<=Authorization:\s*Bearer\s+)[A-Za-z0-9._~+/=-]+/gi,_).replace(/\b(AKIA|ASIA)[A-Z0-9]{12,}\b/g,(s,e)=>`${e}${_}`).replace(/(?<=aws_secret_access_key\s*=\s*["']?|SecretAccessKey[=:]\s*|"(aws)?secretAccessKey":\s*"|"aws_secret_access_key":\s*")[A-Za-z0-9/+=]{40,}/gi,_).replace(/(?<="(aws)?sessionToken":\s*"|"aws_session_token":\s*")[^"]+/gi,_).replace(/(?<=aws_session_token\s*[=:]\s*["']?|SessionToken[=:]\s*["']?)[^\s"']+/gi,_).replace(/(?<="(internal[Aa]piKey|fjallCallbackToken)":\s*")[^"]+/g,_).replace(R,(s,e)=>`${e}${_}`)}A(N,"maskSensitiveOutput");function I(E){const s=[];let e="",t=!1,r=!1,n=!1,c=!1;for(const a of E){if(n){e+=a,n=!1;continue}if(a==="\\"&&!t){n=!0;continue}if(a==="'"&&!r){t=!t,c=!0;continue}if(a==='"'&&!t){r=!r,c=!0;continue}if(a===" "&&!t&&!r){(e||c)&&(s.push(e),e="",c=!1);continue}e+=a}if(t||r)throw new Error(`Unbalanced ${t?"single":"double"} quote in command: ${E.slice(0,80)}`);if(n)throw new Error(`Trailing backslash in command: ${E.slice(0,80)}`);return(e||c)&&s.push(e),s}A(I,"parseShellArgs");export{D as DANGEROUS_ENV_VARS,_ as MASKED_VALUE_MARKER,o as REDACTED_KEY_SENTINEL,u as SCOPED_TOKEN_REGEX,T as filterDangerousEnvVars,N as maskSensitiveOutput,I as parseShellArgs};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "7.2.0",
+  "version": "8.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",