@fjall/util 9.0.0 → 10.1.2

package/dist/.build-source-hash

@@ -9,18 +9,19 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "45c0c260a70c536ef2d05997781c8ccc49866ce559e8d6940f58f9f092c5f250",
+  "hash": "bbdbacc3ff24fe60e8b272d2fae3be6b34b377dccd72015787d69025246230ff",
   "files": {
     "src/async/concurrency.ts": "3c7ebe0222a720f9",
     "src/async/singleton.ts": "7bcc21b0fb920561",
     "src/async/sleep.ts": "df52b17675ec3ed2",
-    "src/aws/CloudFormationFailureAnalyser.ts": "ea858b3dc7332dac",
+    "src/aws/CloudFormationFailureAnalyser.ts": "4e68b353171edd31",
     "src/aws/cloudformationTypes.ts": "e43bab9c96a21856",
     "src/aws/costAllocationTags.ts": "102100b3df7d428e",
     "src/aws/deployProgress.ts": "be09dedb4deb9a7a",
     "src/aws/driftSuspects.ts": "5400dc05ebd6c977",
     "src/aws/errors.ts": "5addfa6bb2d1456a",
-    "src/aws/index.ts": "5f2c5c6c4fd0b600",
+    "src/aws/failureAnalysisCategories.ts": "85ab1632d8069273",
+    "src/aws/index.ts": "d1b45a75d7fb8e28",
     "src/aws/infraTags.ts": "6b1e65bf7119f32c",
     "src/aws/ipamTags.ts": "ac19ecd6c36b3bc2",
     "src/aws/maskFailureAnalysis.ts": "ae11250412cd6fd8",
@@ -58,9 +59,12 @@
     "src/docker/result.ts": "2ff0d59a3add8b06",
     "src/environments.ts": "b3d2f2493554cd0f",
     "src/errorUtils.ts": "c601f2905c74b8d0",
+    "src/failure/deploymentFailure.ts": "5824db1d97d01838",
+    "src/failure/extractErrorWindow.ts": "ca41f90946fa939c",
     "src/fsHelpers.ts": "0869d9739d523572",
     "src/fsScan.ts": "feb187758481443f",
-    "src/index.ts": "79929947a329af6f",
+    "src/httpKeepAlive.ts": "c8fe4b118ef4c79f",
+    "src/index.ts": "78390afd568e517a",
     "src/infra/backupVault.ts": "661678a6dfb0b648",
     "src/infra/connectionsWire.ts": "125c099da0e17ac1",
     "src/infra/deployArtefacts.ts": "235ac21dd3ccf0b2",
@@ -71,14 +75,14 @@
     "src/infra/tokenScopes.ts": "88c6a1f0da3fa491",
     "src/insights/computePatternFingerprint.ts": "b5d3a4704f42cc1f",
     "src/logger.ts": "865ec4ec62a9a588",
-    "src/manifest/index.ts": "b03afdad45154d67",
-    "src/manifest/io.ts": "681888437b87c9d3",
-    "src/manifest/schemas.ts": "8e1f739cb68d6938",
+    "src/manifest/index.ts": "bfa2930556c2f8ad",
+    "src/manifest/io.ts": "915ab602ac92d126",
+    "src/manifest/schemas.ts": "21dce8ba66b1230f",
     "src/mcpProtocol/index.ts": "55df3209915a5043",
     "src/migration/clickhouseSqlUsers.ts": "c916e148367715bb",
     "src/migration/compareSchemaVersion.ts": "1c9247e722ec5d5b",
-    "src/migration/constants.ts": "75c45113184b3653",
-    "src/migration/index.ts": "de586c9d775b3174",
+    "src/migration/constants.ts": "fa7b53cc1e15a245",
+    "src/migration/index.ts": "fc1f4a461d637766",
     "src/migration/pickLatestClickHouseMigration.ts": "a5b4a00ba63522cb",
     "src/migration/pickLatestPrismaMigration.ts": "cbddc2950f4d4c85",
     "src/migration/verifyExpectedSchemaVersion.ts": "cd583329d771a047",
@@ -103,9 +107,9 @@
     "src/securityHelpers.ts": "ee2ab9ffd53119fb",
     "src/targets.ts": "126280f0a5762e21",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "de20bfd9ecd3a130",
+    "package.json": "a2c0e36325985f2e",
     "tsconfig.json": "db759831ad95f396"
   },
-  "outputHash": "d92d1ce1a95c7c760cdd03cefa7cd594c041bb5c0768c96a6806c9d703b6456b",
-  "outputFileCount": 189
+  "outputHash": "2fbb62c936263ba0fed951492d8236364fa5cf422dd6afad9df45dec7746c16c",
+  "outputFileCount": 197
 }

package/dist/.minified

@@ -1 +1 @@
-94 files minified at 2026-08-09T10:16:53.310Z
+98 files minified at 2026-08-12T11:24:47.744Z

package/dist/aws/CloudFormationFailureAnalyser.d.ts

@@ -1,9 +1,10 @@
 import { type ResourceEvent } from "./cloudformationTypes.js";
 import { type DriftSuspectEvent } from "./driftSuspects.js";
+import { type FailureAnalysisCategory } from "./failureAnalysisCategories.js";
 export interface RootCause {
     resource: ResourceEvent;
     reason: string;
-    category: "permissions" | "validation" | "dependency" | "limit" | "network" | "unknown";
+    category: FailureAnalysisCategory;
     isDirectCause: boolean;
 }
 export interface FailureAnalysis {

package/dist/aws/failureAnalysisCategories.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Root-cause categories the CloudFormation failure analyser can assign.
+ * Single source of truth for both the `RootCause` interface
+ * (CloudFormationFailureAnalyser.ts) and the wire-schema enum in
+ * `failure/deploymentFailure.ts` — never redeclare the literals.
+ */
+export declare const FAILURE_ANALYSIS_CATEGORIES: readonly ["permissions", "validation", "dependency", "limit", "network", "unknown"];
+export type FailureAnalysisCategory = (typeof FAILURE_ANALYSIS_CATEGORIES)[number];

package/dist/aws/failureAnalysisCategories.js

@@ -0,0 +1 @@
+const n=["permissions","validation","dependency","limit","network","unknown"];export{n as FAILURE_ANALYSIS_CATEGORIES};

package/dist/aws/index.d.ts

@@ -2,6 +2,7 @@ export { AWSError, NoRolesFoundError, InvalidCredentialsError, SSOTokenExpiredEr
 export { STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, type ResourceEvent, isResourceEvent } from "./cloudformationTypes.js";
 export { type ResourceProgressCounts, countResourceProgress, formatElapsed } from "./deployProgress.js";
 export { CloudFormationFailureAnalyser, type RootCause, type FailureAnalysis } from "./CloudFormationFailureAnalyser.js";
+export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./failureAnalysisCategories.js";
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as i,SSOTokenExpiredError as s,MissingRegionError as E,ProfileNotFoundError as n,CommandError as O,isAWSError as a,isNoRolesFoundError as _,isSSOUnauthorizedError as T}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as p,CDK_NO_STACKS_MATCH as f,isResourceEvent as m}from"./cloudformationTypes.js";import{countResourceProgress as S,formatElapsed as u}from"./deployProgress.js";import{CloudFormationFailureAnalyser as l}from"./CloudFormationFailureAnalyser.js";import{maskFailureAnalysis as d}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as I,findCurrentOperationStart as P,isDriftSuspectReason as F,isOperationOpeningEvent as L}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as c,formatIpamPairTagValue as D}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as g}from"./infraTags.js";import{COST_ALLOCATION_TAGS as G,DEFAULT_COST_ALLOCATION_ENVIRONMENT as U}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as Y}from"./monitoringRole.js";export{Y as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,f as CDK_NO_STACKS_MATCH,G as COST_ALLOCATION_TAGS,l as CloudFormationFailureAnalyser,O as CommandError,U as DEFAULT_COST_ALLOCATION_ENVIRONMENT,c as IPAM_OPERATIONS_POOL_TAG_KEY,i as InvalidCredentialsError,E as MissingRegionError,t as NoRolesFoundError,n as ProfileNotFoundError,g as SDK_PRE_EMPTY_TAG_KEY,s as SSOTokenExpiredError,p as STACK_NOT_FOUND_PATTERN,I as classifyDriftSuspectEvents,S as countResourceProgress,P as findCurrentOperationStart,u as formatElapsed,D as formatIpamPairTagValue,a as isAWSError,F as isDriftSuspectReason,_ as isNoRolesFoundError,L as isOperationOpeningEvent,m as isResourceEvent,T as isSSOUnauthorizedError,d as maskFailureAnalysis};
+import{AWSError as e,NoRolesFoundError as t,InvalidCredentialsError as E,SSOTokenExpiredError as i,MissingRegionError as s,ProfileNotFoundError as n,CommandError as A,isAWSError as O,isNoRolesFoundError as _,isSSOUnauthorizedError as a}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as S,CDK_NO_STACKS_MATCH as p,isResourceEvent as f}from"./cloudformationTypes.js";import{countResourceProgress as N,formatElapsed as C}from"./deployProgress.js";import{CloudFormationFailureAnalyser as R}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as x}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as d}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as L,findCurrentOperationStart as P,isDriftSuspectReason as M,isOperationOpeningEvent as c}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as K,formatIpamPairTagValue as g}from"./ipamTags.js";import{SDK_PRE_EMPTY_TAG_KEY as U}from"./infraTags.js";import{COST_ALLOCATION_TAGS as Y,DEFAULT_COST_ALLOCATION_ENVIRONMENT as y}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as V}from"./monitoringRole.js";export{V as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,p as CDK_NO_STACKS_MATCH,Y as COST_ALLOCATION_TAGS,R as CloudFormationFailureAnalyser,A as CommandError,y as DEFAULT_COST_ALLOCATION_ENVIRONMENT,x as FAILURE_ANALYSIS_CATEGORIES,K as IPAM_OPERATIONS_POOL_TAG_KEY,E as InvalidCredentialsError,s as MissingRegionError,t as NoRolesFoundError,n as ProfileNotFoundError,U as SDK_PRE_EMPTY_TAG_KEY,i as SSOTokenExpiredError,S as STACK_NOT_FOUND_PATTERN,L as classifyDriftSuspectEvents,N as countResourceProgress,P as findCurrentOperationStart,C as formatElapsed,g as formatIpamPairTagValue,O as isAWSError,M as isDriftSuspectReason,_ as isNoRolesFoundError,c as isOperationOpeningEvent,f as isResourceEvent,a as isSSOUnauthorizedError,d as maskFailureAnalysis};

package/dist/failure/deploymentFailure.d.ts

@@ -0,0 +1,317 @@
+/**
+ * Canonical deployment-failure record — the single structured shape every
+ * producer (the deploy-core classifier, the webapp worker's platform-side
+ * shim) and every consumer (webapp UI, CLI renderers, notifications, AI
+ * surfaces) share. Design: aiDocs/designs/2026-08-10-deployment-failure-taxonomy.md § 3.
+ *
+ * Pitfall guards encoded (mirroring docker/dockerCliSchemas.ts):
+ *   - Pitfall 1/6: every exported schema pairs a `z.infer` companion type
+ *   - Pitfall 3: `.strict()` on the envelope and its owned sub-objects; the
+ *     nested analysis alone is non-strict (layered strictness — see below)
+ *   - Pitfall 7: the `remediation` default uses the factory form
+ *   - Pitfall 9: optional strings carry `.min(1)`
+ *
+ * Masking is the producer's job (mask-then-truncate at classification time,
+ * same discipline as `maskFailureAnalysis`); this module only validates and
+ * size-bounds. `docsUrl` is DERIVED from `code` via `deploymentFailureDocsUrl`
+ * and never stored.
+ */
+import { z } from "zod";
+import { type FailureAnalysis } from "../aws/CloudFormationFailureAnalyser.js";
+/** Where in the deploy pipeline the failure occurred. */
+export declare const DEPLOYMENT_FAILURE_PHASES: readonly ["preflight", "credentials", "synth", "bootstrap", "image_build", "image_push", "cloudformation", "ecs_stabilise", "platform", "unknown"];
+export declare const DeploymentFailurePhaseSchema: z.ZodEnum<{
+    unknown: "unknown";
+    platform: "platform";
+    bootstrap: "bootstrap";
+    preflight: "preflight";
+    credentials: "credentials";
+    synth: "synth";
+    image_build: "image_build";
+    image_push: "image_push";
+    cloudformation: "cloudformation";
+    ecs_stabilise: "ecs_stabilise";
+}>;
+export type DeploymentFailurePhase = z.infer<typeof DeploymentFailurePhaseSchema>;
+/** Whose side the failure sits on — drives the presentation verbs. */
+export declare const DEPLOYMENT_FAULT_ATTRIBUTIONS: readonly ["customer_code", "customer_aws", "platform", "indeterminate"];
+export declare const DeploymentFaultAttributionSchema: z.ZodEnum<{
+    platform: "platform";
+    customer_code: "customer_code";
+    customer_aws: "customer_aws";
+    indeterminate: "indeterminate";
+}>;
+export type DeploymentFaultAttribution = z.infer<typeof DeploymentFaultAttributionSchema>;
+/** Which system produced the provider-layer reason. */
+export declare const DEPLOYMENT_FAILURE_PROVIDER_SOURCES: readonly ["cloudformation", "ecs", "ecr", "iam", "docker", "cdk", "npm", "other"];
+export declare const DeploymentFailureProviderSourceSchema: z.ZodEnum<{
+    docker: "docker";
+    ecr: "ecr";
+    other: "other";
+    cloudformation: "cloudformation";
+    ecs: "ecs";
+    iam: "iam";
+    cdk: "cdk";
+    npm: "npm";
+}>;
+export type DeploymentFailureProviderSource = z.infer<typeof DeploymentFailureProviderSourceSchema>;
+/**
+ * Dotted lowercase taxonomy key, e.g. "cfn.resource_create_failed".
+ * Single-segment codes are legal: `unclassified` is a first-class bare code
+ * (phase-scoped variants use `unclassified.<phase>`).
+ */
+export declare const DEPLOYMENT_FAILURE_CODE_PATTERN: RegExp;
+export declare const DEPLOYMENT_FAILURE_SCHEMA_VERSION = 1;
+/**
+ * Size caps for the record and its wire siblings. The webapp's DB/wire
+ * `errorMessage` caps live here too so all sites import one coupled-values
+ * module — the DB and wire caps are deliberately DIFFERENT values (10k DB
+ * bound vs 2k wire excerpt); do not "unify" them.
+ */
+export declare const DEPLOYMENT_FAILURE_LIMITS: {
+    /** `code` — dotted taxonomy key. */
+    readonly code: 128;
+    /** `title` — stable per code; safe for one-line list rendering. */
+    readonly title: 120;
+    /** `detail` — per-occurrence human sentence. */
+    readonly detail: 1000;
+    /** `provider.code` — e.g. a CFN HandlerErrorCode, ECS stopCode, exit code. */
+    readonly providerCode: 128;
+    /** `provider.message` — verbatim (pre-masked) provider reason. */
+    readonly providerMessage: 2000;
+    /** `resource.*` — logical id / resource type / stack name. */
+    readonly resourceField: 256;
+    /** One remediation bullet. */
+    readonly remediationStep: 1024;
+    /** Remediation bullet count. */
+    readonly remediationSteps: 10;
+    /** `excerpt` — capture-time first-error log window, pre-masked. */
+    readonly excerpt: 2000;
+    /** `logRef` — pointer to the full log, never the log itself. */
+    readonly logRef: 512;
+    /** `classifierVersion` — enables re-classification of stored rows. */
+    readonly classifierVersion: 32;
+    /** Nested analysis: any single free-text string (summary, reason, statusReason). */
+    readonly analysisString: 2000;
+    /** Nested analysis: affected-resources cap — a stuck stack can list hundreds. */
+    readonly analysisAffectedResources: 50;
+    /** Nested analysis: dependency-chain cap. */
+    readonly analysisDependencyChain: 50;
+    /** Nested analysis: remediation-bullet cap. */
+    readonly analysisRemediation: 20;
+    /** Nested analysis: drift-suspects cap. */
+    readonly analysisDriftSuspects: 50;
+    /** Wire cap for the derived legacy `errorMessage` composition ("title: detail"). */
+    readonly errorMessageWire: 2000;
+    /** DB cap for the legacy `Deployment.errorMessage` column (mirrors its bound). */
+    readonly errorMessageDb: 10000;
+};
+/**
+ * Wire mirror of `FailureAnalysis` (@fjall/util/aws) — shape-only validation;
+ * size-bounding happens at construction (`toDeploymentFailureAnalysis`) and at
+ * the persistence boundary, never by rejection (an oversized display-only
+ * string must not void the whole record).
+ */
+export declare const DeploymentFailureAnalysisSchema: z.ZodObject<{
+    rootCause: z.ZodObject<{
+        resource: z.ZodObject<{
+            logicalId: z.ZodString;
+            resourceType: z.ZodString;
+            status: z.ZodString;
+            statusReason: z.ZodOptional<z.ZodString>;
+            physicalId: z.ZodOptional<z.ZodString>;
+            timestamp: z.ZodOptional<z.ZodString>;
+            group: z.ZodOptional<z.ZodString>;
+            constructPath: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        reason: z.ZodString;
+        category: z.ZodEnum<{
+            unknown: "unknown";
+            network: "network";
+            permissions: "permissions";
+            validation: "validation";
+            dependency: "dependency";
+            limit: "limit";
+        }>;
+        isDirectCause: z.ZodBoolean;
+    }, z.core.$strip>;
+    affectedResources: z.ZodArray<z.ZodObject<{
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        status: z.ZodString;
+        statusReason: z.ZodOptional<z.ZodString>;
+        physicalId: z.ZodOptional<z.ZodString>;
+        timestamp: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+        constructPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    dependencyChain: z.ZodArray<z.ZodString>;
+    summary: z.ZodString;
+    remediation: z.ZodArray<z.ZodString>;
+    errorPattern: z.ZodOptional<z.ZodString>;
+    driftSuspects: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        logicalId: z.ZodString;
+        resourceType: z.ZodString;
+        physicalId: z.ZodOptional<z.ZodString>;
+        failedStatus: z.ZodString;
+        statusReason: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type DeploymentFailureAnalysis = z.infer<typeof DeploymentFailureAnalysisSchema>;
+/** The Stripe decline_code layer — what AWS/docker/npm actually said. */
+export declare const DeploymentFailureProviderSchema: z.ZodObject<{
+    source: z.ZodEnum<{
+        docker: "docker";
+        ecr: "ecr";
+        other: "other";
+        cloudformation: "cloudformation";
+        ecs: "ecs";
+        iam: "iam";
+        cdk: "cdk";
+        npm: "npm";
+    }>;
+    code: z.ZodOptional<z.ZodString>;
+    message: z.ZodString;
+}, z.core.$strict>;
+export type DeploymentFailureProvider = z.infer<typeof DeploymentFailureProviderSchema>;
+/** The failure's locus, when a specific resource/stack is known. */
+export declare const DeploymentFailureResourceSchema: z.ZodObject<{
+    logicalId: z.ZodOptional<z.ZodString>;
+    resourceType: z.ZodOptional<z.ZodString>;
+    stackName: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type DeploymentFailureResource = z.infer<typeof DeploymentFailureResourceSchema>;
+export declare const DeploymentFailureSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    code: z.ZodString;
+    phase: z.ZodEnum<{
+        unknown: "unknown";
+        platform: "platform";
+        bootstrap: "bootstrap";
+        preflight: "preflight";
+        credentials: "credentials";
+        synth: "synth";
+        image_build: "image_build";
+        image_push: "image_push";
+        cloudformation: "cloudformation";
+        ecs_stabilise: "ecs_stabilise";
+    }>;
+    fault: z.ZodEnum<{
+        platform: "platform";
+        customer_code: "customer_code";
+        customer_aws: "customer_aws";
+        indeterminate: "indeterminate";
+    }>;
+    title: z.ZodString;
+    detail: z.ZodString;
+    provider: z.ZodOptional<z.ZodObject<{
+        source: z.ZodEnum<{
+            docker: "docker";
+            ecr: "ecr";
+            other: "other";
+            cloudformation: "cloudformation";
+            ecs: "ecs";
+            iam: "iam";
+            cdk: "cdk";
+            npm: "npm";
+        }>;
+        code: z.ZodOptional<z.ZodString>;
+        message: z.ZodString;
+    }, z.core.$strict>>;
+    resource: z.ZodOptional<z.ZodObject<{
+        logicalId: z.ZodOptional<z.ZodString>;
+        resourceType: z.ZodOptional<z.ZodString>;
+        stackName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    remediation: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    excerpt: z.ZodOptional<z.ZodString>;
+    logRef: z.ZodOptional<z.ZodString>;
+    analysis: z.ZodOptional<z.ZodObject<{
+        rootCause: z.ZodObject<{
+            resource: z.ZodObject<{
+                logicalId: z.ZodString;
+                resourceType: z.ZodString;
+                status: z.ZodString;
+                statusReason: z.ZodOptional<z.ZodString>;
+                physicalId: z.ZodOptional<z.ZodString>;
+                timestamp: z.ZodOptional<z.ZodString>;
+                group: z.ZodOptional<z.ZodString>;
+                constructPath: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            reason: z.ZodString;
+            category: z.ZodEnum<{
+                unknown: "unknown";
+                network: "network";
+                permissions: "permissions";
+                validation: "validation";
+                dependency: "dependency";
+                limit: "limit";
+            }>;
+            isDirectCause: z.ZodBoolean;
+        }, z.core.$strip>;
+        affectedResources: z.ZodArray<z.ZodObject<{
+            logicalId: z.ZodString;
+            resourceType: z.ZodString;
+            status: z.ZodString;
+            statusReason: z.ZodOptional<z.ZodString>;
+            physicalId: z.ZodOptional<z.ZodString>;
+            timestamp: z.ZodOptional<z.ZodString>;
+            group: z.ZodOptional<z.ZodString>;
+            constructPath: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        dependencyChain: z.ZodArray<z.ZodString>;
+        summary: z.ZodString;
+        remediation: z.ZodArray<z.ZodString>;
+        errorPattern: z.ZodOptional<z.ZodString>;
+        driftSuspects: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            logicalId: z.ZodString;
+            resourceType: z.ZodString;
+            physicalId: z.ZodOptional<z.ZodString>;
+            failedStatus: z.ZodString;
+            statusReason: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    classifierVersion: z.ZodString;
+}, z.core.$strict>;
+export type DeploymentFailure = z.infer<typeof DeploymentFailureSchema>;
+/**
+ * Validate a wire/JSONB value into a `DeploymentFailure`, returning null for
+ * absent/malformed input — consumers render the legacy `errorMessage` fallback
+ * rather than crashing on a record a newer/older engine produced.
+ */
+export declare function parseDeploymentFailure(raw: unknown): DeploymentFailure | null;
+export declare const DEPLOYMENT_FAILURE_DOCS_BASE_URL = "https://docs.fjall.io/errors";
+/** `docsUrl` is derived from `code`, never stored (Vercel/Stripe pattern). */
+export declare function deploymentFailureDocsUrl(code: string): string;
+/**
+ * Fault-attribution copy shared by every renderer (CLI Ink, non-interactive,
+ * webapp Tier 2) so the product speaks with one voice about whose side a
+ * failure sits on. Exhaustive over the fault enum — a new attribution fails to
+ * compile here. Webapp mirror: FAULT_COPY at
+ * webapp/app/components/deployment/deployment-status-header.tsx (byte-identical
+ * strings until the engine-dependency bump replaces the mirror).
+ */
+export declare const DEPLOYMENT_FAULT_COPY: Record<DeploymentFaultAttribution, string>;
+/**
+ * Display labels for the provider-source enum, shared by every renderer.
+ * Exhaustive — a new source fails to compile here. Webapp mirror:
+ * PROVIDER_LABELS at
+ * webapp/app/components/deployment/deployment-status-header.tsx.
+ */
+export declare const DEPLOYMENT_PROVIDER_LABELS: Record<DeploymentFailureProviderSource, string>;
+/**
+ * Compose the derived legacy `errorMessage` from a failure record
+ * ("title: detail", wire-bounded) — writers persist this alongside `failure`
+ * so grep/SQL consumers and pre-taxonomy readers keep working. Webapp mirror:
+ * deriveErrorMessageFromFailure at
+ * webapp/app/lib/deployment/deployment-failure.ts (same name so the
+ * engine-dependency bump swaps the import without a rename).
+ */
+export declare function deriveErrorMessageFromFailure(failure: DeploymentFailure): string;
+/**
+ * Convert the in-memory `FailureAnalysis` (Date timestamps) into the JSON-safe
+ * wire form nested inside a `DeploymentFailure`, size-bounding arrays and
+ * free-text so the record stays within its persistence budget. Pure — does not
+ * mask (the engine producer already masked via `maskFailureAnalysis`).
+ */
+export declare function toDeploymentFailureAnalysis(analysis: FailureAnalysis): DeploymentFailureAnalysis;

package/dist/failure/deploymentFailure.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var s=(r,o)=>c(r,"name",{value:o,configurable:!0});import{z as e}from"zod";import{FAILURE_ANALYSIS_CATEGORIES as l}from"../aws/failureAnalysisCategories.js";const u=["preflight","credentials","synth","bootstrap","image_build","image_push","cloudformation","ecs_stabilise","platform","unknown"],d=e.enum(u),p=["customer_code","customer_aws","platform","indeterminate"],m=e.enum(p),g=["cloudformation","ecs","ecr","iam","docker","cdk","npm","other"],f=e.enum(g),y=/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/,S=1,t={code:128,title:120,detail:1e3,providerCode:128,providerMessage:2e3,resourceField:256,remediationStep:1024,remediationSteps:10,excerpt:2e3,logRef:512,classifierVersion:32,analysisString:2e3,analysisAffectedResources:50,analysisDependencyChain:50,analysisRemediation:20,analysisDriftSuspects:50,errorMessageWire:2e3,errorMessageDb:1e4},a=e.object({logicalId:e.string(),resourceType:e.string(),status:e.string(),statusReason:e.string().optional(),physicalId:e.string().optional(),timestamp:e.string().optional(),group:e.string().optional(),constructPath:e.string().optional()}),h=e.object({logicalId:e.string(),resourceType:e.string(),physicalId:e.string().optional(),failedStatus:e.string(),statusReason:e.string()}),E=e.object({rootCause:e.object({resource:a,reason:e.string(),category:e.enum(l),isDirectCause:e.boolean()}),affectedResources:e.array(a),dependencyChain:e.array(e.string()),summary:e.string(),remediation:e.array(e.string()),errorPattern:e.string().optional(),driftSuspects:e.array(h).optional()}),R=e.object({source:f,code:e.string().min(1).max(t.providerCode).optional(),message:e.string().max(t.providerMessage)}).strict(),x=e.object({logicalId:e.string().min(1).max(t.resourceField).optional(),resourceType:e.string().min(1).max(t.resourceField).optional(),stackName:e.string().min(1).max(t.resourceField).optional()}).strict(),_=e.object({schemaVersion:e.literal(S),code:e.string().min(1).max(t.code).regex(y,"Failure codes are dotted lowercase keys, e.g. cfn.resource_create_failed"),phase:d,fault:m,title:e.string().min(1).max(t.title),detail:e.string().min(1).max(t.detail),provider:R.optional(),resource:x.optional(),remediation:e.array(e.string().min(1).max(t.remediationStep)).max(t.remediationSteps).default(()=>[]),excerpt:e.string().min(1).max(t.excerpt).optional(),logRef:e.string().min(1).max(t.logRef).optional(),analysis:E.optional(),classifierVersion:e.string().min(1).max(t.classifierVersion)}).strict();function C(r){if(r==null)return null;const o=_.safeParse(r);return o.success?o.data:null}s(C,"parseDeploymentFailure");const D="https://docs.fjall.io/errors";function P(r){return`${D}/${r}`}s(P,"deploymentFailureDocsUrl");const L={platform:"This was a problem on Fjall's side, not in your code or AWS account \u2014 retrying is safe.",customer_aws:"The failure came from your AWS account's configuration, permissions, or limits.",customer_code:"The failure came from the application's code or configuration.",indeterminate:"The cause could not be attributed automatically \u2014 the details below show what was reported."},M={cloudformation:"CloudFormation",ecs:"ECS",ecr:"ECR",iam:"IAM",docker:"Docker",cdk:"CDK",npm:"npm",other:"The provider"};function O(r){const o=`${r.title}: ${r.detail}`;return o.length>t.errorMessageWire?o.slice(0,t.errorMessageWire):o}s(O,"deriveErrorMessageFromFailure");function i(r){return r.length>t.analysisString?r.slice(0,t.analysisString):r}s(i,"truncateAnalysisString");function n(r){return{logicalId:r.logicalId,resourceType:r.resourceType,status:r.status,timestamp:r.timestamp.toISOString(),...r.statusReason!==void 0&&{statusReason:i(r.statusReason)},...r.physicalId!==void 0&&{physicalId:r.physicalId},...r.group!==void 0&&{group:r.group},...r.constructPath!==void 0&&{constructPath:r.constructPath}}}s(n,"toWireResourceEvent");function I(r){return{logicalId:r.logicalId,resourceType:r.resourceType,failedStatus:r.failedStatus,statusReason:i(r.statusReason),...r.physicalId!==void 0&&{physicalId:r.physicalId}}}s(I,"toWireDriftSuspect");function b(r){return{rootCause:{resource:n(r.rootCause.resource),reason:i(r.rootCause.reason),category:r.rootCause.category,isDirectCause:r.rootCause.isDirectCause},affectedResources:r.affectedResources.slice(0,t.analysisAffectedResources).map(n),dependencyChain:r.dependencyChain.slice(0,t.analysisDependencyChain).map(i),summary:i(r.summary),remediation:r.remediation.slice(0,t.analysisRemediation).map(i),...r.errorPattern!==void 0&&{errorPattern:i(r.errorPattern)},...r.driftSuspects!==void 0&&{driftSuspects:r.driftSuspects.slice(0,t.analysisDriftSuspects).map(I)}}}s(b,"toDeploymentFailureAnalysis");export{y as DEPLOYMENT_FAILURE_CODE_PATTERN,D as DEPLOYMENT_FAILURE_DOCS_BASE_URL,t as DEPLOYMENT_FAILURE_LIMITS,u as DEPLOYMENT_FAILURE_PHASES,g as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,S as DEPLOYMENT_FAILURE_SCHEMA_VERSION,p as DEPLOYMENT_FAULT_ATTRIBUTIONS,L as DEPLOYMENT_FAULT_COPY,M as DEPLOYMENT_PROVIDER_LABELS,E as DeploymentFailureAnalysisSchema,d as DeploymentFailurePhaseSchema,R as DeploymentFailureProviderSchema,f as DeploymentFailureProviderSourceSchema,x as DeploymentFailureResourceSchema,_ as DeploymentFailureSchema,m as DeploymentFaultAttributionSchema,P as deploymentFailureDocsUrl,O as deriveErrorMessageFromFailure,C as parseDeploymentFailure,b as toDeploymentFailureAnalysis};

package/dist/failure/extractErrorWindow.d.ts

@@ -0,0 +1,21 @@
+/**
+ * First-error window extraction for deployment logs — the shared primitive
+ * behind `DeploymentFailure.excerpt` (design § 4). Scans for the first line
+ * matching an anchored error-pattern set, keeps a ±N-line window around it,
+ * and caps the result. Masks BEFORE any slicing (security-standards
+ * "mask before you truncate"); with no anchor it falls back to the TAIL, not
+ * the head — the head of a CDK log is its least informative part.
+ */
+/** Lines of context kept either side of the anchor line. */
+export declare const ERROR_WINDOW_CONTEXT_LINES = 20;
+export interface ExtractErrorWindowOptions {
+    /** Hard cap in UTF-16 code units. Default: `DEPLOYMENT_FAILURE_LIMITS.excerpt`. */
+    maxLength?: number;
+    /** Context lines kept either side of the anchor line. Default: `ERROR_WINDOW_CONTEXT_LINES`. */
+    contextLines?: number;
+}
+/**
+ * Extract a bounded first-error window from a deployment log. Returns the
+ * masked log verbatim when it already fits the cap.
+ */
+export declare function extractErrorWindow(log: string, options?: ExtractErrorWindowOptions): string;

package/dist/failure/extractErrorWindow.js

@@ -0,0 +1,8 @@
+var A=Object.defineProperty;var d=(t,n)=>A(t,"name",{value:n,configurable:!0});import{maskSensitiveOutput as S}from"../securityHelpers.js";import{DEPLOYMENT_FAILURE_LIMITS as C}from"./deploymentFailure.js";const N=[/❌/,/Resource handler returned message/i,/(?:CREATE|UPDATE|DELETE|IMPORT)_FAILED/,/ROLLBACK_(?:IN_PROGRESS|COMPLETE|FAILED)/],_=[/npm ERR!/,/error TS\d+/,/SyntaxError:/],T=[/Error occurred/i,/\berror:/i,/\bfailed:/i,/\bdenied\b/i,/\bexception\b/i],b=[...N,..._,...T],D=20,e="\u2026";function M(t,n){const r=Math.max(0,n);if(t.length<=r)return t;let c=r;const o=t.charCodeAt(c-1);return o>=55296&&o<=56319&&(c-=1),t.slice(0,c)}d(M,"truncateUtf16Safe");function w(t){const n=t.charCodeAt(0);return n>=56320&&n<=57343?t.slice(1):t}d(w,"trimLeadingLoneSurrogate");function P(t){return b.some(n=>n.test(t))}d(P,"isAnchorLine");function $(t,n={}){const r=n.maxLength??C.excerpt,c=n.contextLines??D,o=S(t);if(o.length<=r)return o;const s=o.split(`
+`),i=s.findIndex(P);if(i===-1)return e+w(o.slice(-(r-1)));const E=Math.min(s.length,i+c+1),h=s.slice(i,E).join(`
+`),L=i>0,I=E<s.length,a=r-(L?e.length+1:0)-e.length;if(h.length>a)return(L?`${e}
+`:"")+M(h,a)+e;const u=Math.max(0,i-c),g=I?`
+${e}`:"",x=[];let l=0;for(let f=i-1;f>=u;f--){const R=s[f]??"",O=l+R.length+1;if((f>0?e.length+1:0)+O+h.length+g.length>r)break;x.unshift(R),l=O}const m=i-x.length>0?`${e}
+`:"",p=x.length>0?`${x.join(`
+`)}
+`:"";return m+p+h+g}d($,"extractErrorWindow");export{D as ERROR_WINDOW_CONTEXT_LINES,$ as extractErrorWindow};

package/dist/httpKeepAlive.d.ts

@@ -0,0 +1,49 @@
+/**
+ * ALB ↔ Node HTTP keep-alive contract.
+ *
+ * An ALB holds idle keep-alive connections to its targets open for up to its
+ * idle timeout and freely reuses them. Node's default `server.keepAliveTimeout`
+ * is 5 seconds — far below the ALB's 60 — so the ALB routinely reuses a
+ * connection at the instant Node closes it, surfacing as intermittent
+ * ALB-generated 502s that never reach the application. The fix is server-side:
+ * the target's keep-alive timeout must exceed the ALB idle timeout, and
+ * `headersTimeout` must exceed `keepAliveTimeout` so a request that starts
+ * arriving just before the keep-alive deadline is not truncated mid-headers.
+ *
+ * The Fjall ECS construct pins the ALB idle timeout to
+ * `DEFAULT_ALB_IDLE_TIMEOUT_SECONDS` and injects that value into ALB-fronted
+ * containers as `FJALL_ALB_IDLE_TIMEOUT_SECONDS` (see
+ * `components/infrastructure/lib/resources/aws/compute/applicationLoadBalancer.ts`).
+ * This module is the consuming half of the contract: call
+ * `applyAlbKeepAliveTimeouts(server)` after `listen()`. When the env var is
+ * absent (local dev, containers deployed before the construct injected it) the
+ * AWS default of 60 seconds is assumed, which yields the same timeouts.
+ */
+export declare const FJALL_ALB_IDLE_TIMEOUT_ENV_VAR = "FJALL_ALB_IDLE_TIMEOUT_SECONDS";
+/**
+ * The ALB idle timeout every Fjall ALB is pinned to (also the AWS default,
+ * assumed when the env var is absent). The construct imports this constant so
+ * the ALB attribute, the injected env var, and this fallback cannot drift.
+ */
+export declare const DEFAULT_ALB_IDLE_TIMEOUT_SECONDS = 60;
+export interface AlbKeepAliveTimeouts {
+    albIdleTimeoutSeconds: number;
+    keepAliveTimeoutMs: number;
+    headersTimeoutMs: number;
+}
+/** Structural subset of `node:http.Server` this module tunes. */
+export interface KeepAliveTunableServer {
+    keepAliveTimeout: number;
+    headersTimeout: number;
+}
+/**
+ * Resolves the keep-alive timeouts for a server behind a Fjall ALB from
+ * `FJALL_ALB_IDLE_TIMEOUT_SECONDS`. Throws on a malformed value — a
+ * misconfigured contract must fail the boot loudly, not race the ALB.
+ */
+export declare function resolveAlbKeepAliveTimeouts(env?: Record<string, string | undefined>): AlbKeepAliveTimeouts;
+/**
+ * Applies the resolved timeouts to a Node HTTP(S) server and returns them so
+ * the caller can log what was applied.
+ */
+export declare function applyAlbKeepAliveTimeouts(server: KeepAliveTunableServer, env?: Record<string, string | undefined>): AlbKeepAliveTimeouts;

package/dist/httpKeepAlive.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var _=(o,e)=>i(o,"name",{value:e,configurable:!0});const E="FJALL_ALB_IDLE_TIMEOUT_SECONDS",T=60,r=5,u=1e3;function n(o=process.env){const e=o[E];let t=60;if(e!==void 0){if(!/^[0-9]+$/.test(e)||Number.parseInt(e,10)<=0)throw new Error(`${E} must be a positive integer number of seconds, got ${JSON.stringify(e)} \u2014 unset it to assume the AWS default of ${String(60)}`);t=Number.parseInt(e,10)}const s=(t+5)*1e3;return{albIdleTimeoutSeconds:t,keepAliveTimeoutMs:s,headersTimeoutMs:s+1e3}}_(n,"resolveAlbKeepAliveTimeouts");function I(o,e=process.env){const t=n(e);return o.keepAliveTimeout=t.keepAliveTimeoutMs,o.headersTimeout=t.headersTimeoutMs,t}_(I,"applyAlbKeepAliveTimeouts");export{T as DEFAULT_ALB_IDLE_TIMEOUT_SECONDS,E as FJALL_ALB_IDLE_TIMEOUT_ENV_VAR,I as applyAlbKeepAliveTimeouts,n as resolveAlbKeepAliveTimeouts};

package/dist/index.d.ts

@@ -33,3 +33,5 @@ export { PATTERN_TYPE_VALUES, type PatternType, PATTERN_TYPES, isPatternType, ty
 export { DEFAULT_FORMS_FROM_LOCAL_PART, defaultFormsFromAddress, defaultFormsCorsOrigin, isAddressAtDomain } from "./patterns/staticSiteForms.js";
 export { DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION, DEV_SUBSTRATE_PARAMS_FILENAME, DevSubstrateSynthPropsSchema, type DevSubstrateSynthProps, DevSubstrateParamsSchema, type DevSubstrateParams } from "./devSubstrate/params.js";
 export { DEV_SUBSTRATE_ENTRYPOINT_SOURCE } from "./devSubstrate/entrypoint.js";
+export { DEPLOYMENT_FAILURE_PHASES, DeploymentFailurePhaseSchema, type DeploymentFailurePhase, DEPLOYMENT_FAULT_ATTRIBUTIONS, DeploymentFaultAttributionSchema, type DeploymentFaultAttribution, DEPLOYMENT_FAILURE_PROVIDER_SOURCES, DeploymentFailureProviderSourceSchema, type DeploymentFailureProviderSource, DEPLOYMENT_FAILURE_CODE_PATTERN, DEPLOYMENT_FAILURE_SCHEMA_VERSION, DEPLOYMENT_FAILURE_LIMITS, DeploymentFailureAnalysisSchema, type DeploymentFailureAnalysis, DeploymentFailureProviderSchema, type DeploymentFailureProvider, DeploymentFailureResourceSchema, type DeploymentFailureResource, DeploymentFailureSchema, type DeploymentFailure, parseDeploymentFailure, DEPLOYMENT_FAILURE_DOCS_BASE_URL, deploymentFailureDocsUrl, DEPLOYMENT_FAULT_COPY, DEPLOYMENT_PROVIDER_LABELS, deriveErrorMessageFromFailure, toDeploymentFailureAnalysis } from "./failure/deploymentFailure.js";
+export { extractErrorWindow, ERROR_WINDOW_CONTEXT_LINES, type ExtractErrorWindowOptions } from "./failure/extractErrorWindow.js";

package/dist/index.js

@@ -1 +1 @@
-import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as i,TOKEN_STDERR_PREFIX as R}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as s,toKebab as O,toValidDatabaseName as P,toScreamingSnake as p,capitalise as c,getSafeZoneName as I,accountConstructKey as f,hasAsciiStableConstructKey as D}from"./naming/caseConversion.js";import{albDnsExportName as M,albHostedZoneIdExportName as d,cdnDomainExportName as x,bucketWebsiteEndpointExportName as u,bucketWebsiteHostedZoneIdExportName as L}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as l,CAPACITY_SLOT_MAX_LENGTH as V,DEFAULT_CAPACITY_SLOT as h,CAPACITY_ANCHOR_PATTERN as G,CAPACITY_ANCHOR_MAX_LENGTH as F,CAPACITY_IDENTITY_CONTEXT_KEY as H,CapacityIdentityPinSchema as v,CapacityIdentityWireSchema as Y,CapacityIdentityConfigSchema as y,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as K}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as W,suffixedAccountName as k,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as j,regionSuffixRejectionMessage as z}from"./naming/connectedAccountName.js";import{normaliseError as q,getErrorMessage as w,hasErrorCode as J,getErrorCode as $,getErrorStack as ee,formatErrorString as Ee}from"./errorUtils.js";import{singleton as te}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as _e,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ae,maskSensitiveOutput as Se,parseShellArgs as Te,REDACTED_KEY_SENTINEL as ne,SCOPED_TOKEN_REGEX as ie}from"./securityHelpers.js";import{sleep as Ne}from"./async/sleep.js";import{mapSettledWithConcurrency as Ce}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Oe,STRUCTURAL_ENVIRONMENTS as Pe,ACCOUNT_STAGES as pe,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Ie,ACCOUNT_TIERS as fe,AccountTierSchema as De,isAccountTier as ge,GOVERNANCE_ACCOUNT_TIERS as Me,isGovernanceTier as de,environmentToTier as xe,stageFromWireEnvironment as ue,accountTier as Le,resolveSynthEnvironment as Ue,getEnvironmentLabel as le,ACCOUNT_ROLES as Ve}from"./environments.js";import{RESOURCE_CATEGORIES as Ge,categoriseResource as Fe,getExpectedDuration as He,getFriendlyResourceType as ve}from"./resourceCategorisation.js";import{parseGitRemoteUrl as ye}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Xe,AWS_REGIONS_METADATA as Ke,DEFAULT_REGION as Be,getRegionInfo as We,MAX_SECONDARY_REGIONS as ke,OPT_IN_REGION_CODES as Ze,optInRegionWarning as je,regions as ze,suggestRegionForTimezone as Qe}from"./infra/regions.js";import{SCOPE_VALUES as we,MACHINE_ONLY_SCOPES as Je,USER_GRANTABLE_SCOPES as $e,GOVERNANCE_SCOPE_REQUIRED_CODE as eE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as rE,SECRET_NAME_ERROR as tE,SSM_COMPONENT_PATTERN as oE,SSM_COMPONENT_ERROR as _E,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as AE,buildNamespaceParts as SE,buildParameterPath as TE,parseParameterPath as nE,isManageablePath as iE,parseDotEnv as RE,escapeDotEnvValue as NE}from"./secrets.js";import{ConnectionWireSchema as CE,ConnectionsListResponseSchema as sE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as PE,deriveTargets as pE,deriveAllTargets as cE,environmentOrTier as IE,findTarget as fE,generateTargetName as DE}from"./targets.js";import{buildAppConfigPath as ME}from"./repo/appPath.js";import{findInfrastructurePaths as xE,findBoundaryPath as uE,isInfrastructureFile as LE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as lE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as hE,RESERVED_APP_NAME_MESSAGE as GE,isReservedAppName as FE,RESERVED_APP_NAME_SUFFIX as HE,RESERVED_APP_NAME_SUFFIX_MESSAGE as vE,hasReservedAppNameSuffix as YE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as bE,CONTENT_HASH_TAG_PATTERN as XE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as BE,DeployModeSchema as WE,IMAGE_TAG_PATTERN as kE,ImageTagSchema as ZE,ServiceArtefactSchema as jE,ServiceArtefactsSchema as zE,ARTEFACT_OUTPUT_FIELDS as QE,artefactOutputKey as qE}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as JE,EXPECTED_SCHEMA_VERSION_ENV as $E,EXPECTED_SCHEMA_VERSION_TOOL_ENV as er,EXPECTED_CH_SCHEMA_VERSION_ENV as Er,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as tr,PRISMA_MIGRATION_DIR_RE as or,CLICKHOUSE_MIGRATION_SKIP_RE as _r}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Ar}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Tr,PATTERN_TYPES as nr,isPatternType as ir,PATTERN_REGISTRY as Rr,DEPLOYABLE_PATTERN_TYPES as Nr,OPENNEXT_PATTERN_TYPES as mr,isOpenNextPatternType as Cr,STATIC_SITE_ROUTING_VALUES as sr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as Pr,defaultFormsFromAddress as pr,defaultFormsCorsOrigin as cr,isAddressAtDomain as Ir}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as Dr,DEV_SUBSTRATE_PARAMS_FILENAME as gr,DevSubstrateSynthPropsSchema as Mr,DevSubstrateParamsSchema as dr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as ur}from"./devSubstrate/entrypoint.js";export{Ve as ACCOUNT_ROLES,pe as ACCOUNT_STAGES,Oe as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,fe as ACCOUNT_TIERS,i as APPROVAL_TOKEN_OUTPUT_PREFIX,QE as ARTEFACT_OUTPUT_FIELDS,Ke as AWS_REGIONS_METADATA,De as AccountTierSchema,T as BACKUP_VAULT_NAME,F as CAPACITY_ANCHOR_MAX_LENGTH,G as CAPACITY_ANCHOR_PATTERN,H as CAPACITY_IDENTITY_CONTEXT_KEY,V as CAPACITY_SLOT_MAX_LENGTH,l as CAPACITY_SLOT_PATTERN,_r as CLICKHOUSE_MIGRATION_SKIP_RE,XE as CONTENT_HASH_TAG_PATTERN,y as CapacityIdentityConfigSchema,v as CapacityIdentityPinSchema,Y as CapacityIdentityWireSchema,CE as ConnectionWireSchema,sE as ConnectionsListResponseSchema,_e as DANGEROUS_ENV_VARS,h as DEFAULT_CAPACITY_SLOT,Pr as DEFAULT_FORMS_FROM_LOCAL_PART,Be as DEFAULT_REGION,Nr as DEPLOYABLE_PATTERN_TYPES,BE as DEPLOY_MODES,ur as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,gr as DEV_SUBSTRATE_PARAMS_FILENAME,Dr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,WE as DeployModeSchema,dr as DevSubstrateParamsSchema,Mr as DevSubstrateSynthPropsSchema,Er as EXPECTED_CH_SCHEMA_VERSION_ENV,$E as EXPECTED_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Me as GOVERNANCE_ACCOUNT_TIERS,eE as GOVERNANCE_SCOPE_REQUIRED_CODE,kE as IMAGE_TAG_PATTERN,ZE as ImageTagSchema,Je as MACHINE_ONLY_SCOPES,Ae as MASKED_VALUE_MARKER,ke as MAX_SECONDARY_REGIONS,JE as MIGRATION_SNAPSHOT_NAME_PREFIX,mr as OPENNEXT_PATTERN_TYPES,Ze as OPT_IN_REGION_CODES,Rr as PATTERN_REGISTRY,nr as PATTERN_TYPES,Tr as PATTERN_TYPE_VALUES,Ar as PHYSICAL_NAME_FALLBACK_PROPERTIES,or as PRISMA_MIGRATION_DIR_RE,ne as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,hE as RESERVED_APP_NAMES,GE as RESERVED_APP_NAME_MESSAGE,HE as RESERVED_APP_NAME_SUFFIX,vE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ge as RESOURCE_CATEGORIES,tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,ie as SCOPED_TOKEN_REGEX,we as SCOPE_VALUES,tE as SECRET_NAME_ERROR,rE as SECRET_NAME_PATTERN,_E as SSM_COMPONENT_ERROR,oE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,sr as STATIC_SITE_ROUTING_VALUES,Pe as STRUCTURAL_ENVIRONMENTS,AE as SecretNamespaceSchema,jE as ServiceArtefactSchema,zE as ServiceArtefactsSchema,R as TOKEN_STDERR_PREFIX,$e as USER_GRANTABLE_SCOPES,Xe as abbreviateRegion,f as accountConstructKey,Le as accountTier,M as albDnsExportName,d as albHostedZoneIdExportName,qE as artefactOutputKey,u as bucketWebsiteEndpointExportName,L as bucketWebsiteHostedZoneIdExportName,ME as buildAppConfigPath,SE as buildNamespaceParts,TE as buildParameterPath,c as capitalise,Fe as categoriseResource,x as cdnDomainExportName,W as defaultConnectedAccountName,cr as defaultFormsCorsOrigin,pr as defaultFormsFromAddress,cE as deriveAllTargets,bE as deriveContentHashTag,PE as deriveRegionsFromOrgConfig,pE as deriveTargets,IE as environmentOrTier,xe as environmentToTier,NE as escapeDotEnvValue,ae as filterDangerousEnvVars,K as findAccountNameCollision,uE as findBoundaryPath,xE as findInfrastructurePaths,fE as findTarget,j as findTrailingRegionShortCode,Ee as formatErrorString,DE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,le as getEnvironmentLabel,$ as getErrorCode,w as getErrorMessage,ee as getErrorStack,He as getExpectedDuration,ve as getFriendlyResourceType,We as getRegionInfo,I as getSafeZoneName,D as hasAsciiStableConstructKey,J as hasErrorCode,YE as hasReservedAppNameSuffix,m as imageTagParameterName,lE as inferContainerFromCandidates,Ie as isAccountStage,ge as isAccountTier,Ir as isAddressAtDomain,de as isGovernanceTier,LE as isInfrastructureFile,iE as isManageablePath,a as isManagedDomainBinding,Cr as isOpenNextPatternType,ir as isPatternType,FE as isReservedAppName,Ce as mapSettledWithConcurrency,Se as maskSensitiveOutput,q as normaliseError,je as optInRegionWarning,RE as parseDotEnv,ye as parseGitRemoteUrl,nE as parseParameterPath,Te as parseShellArgs,b as projectCapacityIdentityToTarget,z as regionSuffixRejectionMessage,ze as regions,Ue as resolveSynthEnvironment,te as singleton,Ne as sleep,ue as stageFromWireEnvironment,k as suffixedAccountName,Qe as suggestRegionForTimezone,O as toKebab,s as toPascalCase,p as toScreamingSnake,P as toValidDatabaseName};
+import{DNS_APEX as r,getDomainExportNames as t,getDomainStackName as o,getDomainUsEast1CertificatesStackName as _,isManagedDomainBinding as a,DOMAIN_DEPLOY_DEFAULT_PHASE as A}from"./infra/domainExports.js";import{BACKUP_VAULT_NAME as T}from"./infra/backupVault.js";import{APPROVAL_TOKEN_OUTPUT_PREFIX as n,TOKEN_STDERR_PREFIX as R}from"./deploy/approvalTokenOutput.js";import{imageTagParameterName as m}from"./infra/imageTags.js";import{toPascalCase as P,toKebab as C,toValidDatabaseName as s,toScreamingSnake as p,capitalise as c,getSafeZoneName as I,accountConstructKey as D,hasAsciiStableConstructKey as f}from"./naming/caseConversion.js";import{albDnsExportName as L,albHostedZoneIdExportName as l,cdnDomainExportName as g,bucketWebsiteEndpointExportName as u,bucketWebsiteHostedZoneIdExportName as d}from"./naming/targetExportNames.js";import{CAPACITY_SLOT_PATTERN as x,CAPACITY_SLOT_MAX_LENGTH as F,DEFAULT_CAPACITY_SLOT as h,CAPACITY_ANCHOR_PATTERN as V,CAPACITY_ANCHOR_MAX_LENGTH as y,CAPACITY_IDENTITY_CONTEXT_KEY as Y,CapacityIdentityPinSchema as G,CapacityIdentityWireSchema as v,CapacityIdentityConfigSchema as H,projectCapacityIdentityToTarget as b}from"./capacityIdentity.js";import{findAccountNameCollision as K}from"./naming/accountNameCollision.js";import{defaultConnectedAccountName as W,suffixedAccountName as k,REGION_SHORT_CODES as Z,findTrailingRegionShortCode as j,regionSuffixRejectionMessage as w}from"./naming/connectedAccountName.js";import{normaliseError as Q,getErrorMessage as q,hasErrorCode as J,getErrorCode as $,getErrorStack as ee,formatErrorString as Ee}from"./errorUtils.js";import{singleton as te}from"./async/singleton.js";import{DANGEROUS_ENV_VARS as _e,filterDangerousEnvVars as ae,MASKED_VALUE_MARKER as Ae,maskSensitiveOutput as Se,parseShellArgs as Te,REDACTED_KEY_SENTINEL as ie,SCOPED_TOKEN_REGEX as ne}from"./securityHelpers.js";import{sleep as Ne}from"./async/sleep.js";import{mapSettledWithConcurrency as Oe}from"./async/concurrency.js";import{ACCOUNT_STAGES_WITH_ROOT as Ce,STRUCTURAL_ENVIRONMENTS as se,ACCOUNT_STAGES as pe,ACCOUNT_STAGE_LABELS as ce,isAccountStage as Ie,ACCOUNT_TIERS as De,AccountTierSchema as fe,isAccountTier as Me,GOVERNANCE_ACCOUNT_TIERS as Le,isGovernanceTier as le,environmentToTier as ge,stageFromWireEnvironment as ue,accountTier as de,resolveSynthEnvironment as Ue,getEnvironmentLabel as xe,ACCOUNT_ROLES as Fe}from"./environments.js";import{RESOURCE_CATEGORIES as Ve,categoriseResource as ye,getExpectedDuration as Ye,getFriendlyResourceType as Ge}from"./resourceCategorisation.js";import{parseGitRemoteUrl as He}from"./repo/gitRemoteParser.js";import{abbreviateRegion as Xe,AWS_REGIONS_METADATA as Ke,DEFAULT_REGION as Be,getRegionInfo as We,MAX_SECONDARY_REGIONS as ke,OPT_IN_REGION_CODES as Ze,optInRegionWarning as je,regions as we,suggestRegionForTimezone as ze}from"./infra/regions.js";import{SCOPE_VALUES as qe,MACHINE_ONLY_SCOPES as Je,USER_GRANTABLE_SCOPES as $e,GOVERNANCE_SCOPE_REQUIRED_CODE as eE}from"./infra/tokenScopes.js";import{SECRET_NAME_PATTERN as rE,SECRET_NAME_ERROR as tE,SSM_COMPONENT_PATTERN as oE,SSM_COMPONENT_ERROR as _E,SSM_STANDARD_MAX_VALUE_BYTES as aE,SecretNamespaceSchema as AE,buildNamespaceParts as SE,buildParameterPath as TE,parseParameterPath as iE,isManageablePath as nE,parseDotEnv as RE,escapeDotEnvValue as NE}from"./secrets.js";import{ConnectionWireSchema as OE,ConnectionsListResponseSchema as PE}from"./infra/connectionsWire.js";import{deriveRegionsFromOrgConfig as sE,deriveTargets as pE,deriveAllTargets as cE,environmentOrTier as IE,findTarget as DE,generateTargetName as fE}from"./targets.js";import{buildAppConfigPath as LE}from"./repo/appPath.js";import{findInfrastructurePaths as gE,findBoundaryPath as uE,isInfrastructureFile as dE}from"./repo/findInfrastructurePaths.js";import{inferContainerFromCandidates as xE}from"./repo/inferContainerFromCandidates.js";import{RESERVED_APP_NAMES as hE,RESERVED_APP_NAME_MESSAGE as VE,isReservedAppName as yE,RESERVED_APP_NAME_SUFFIX as YE,RESERVED_APP_NAME_SUFFIX_MESSAGE as GE,hasReservedAppNameSuffix as vE}from"./naming/reservedAppNames.js";import{deriveContentHashTag as bE,CONTENT_HASH_TAG_PATTERN as XE}from"./infra/deriveContentHashTag.js";import{DEPLOY_MODES as BE,DeployModeSchema as WE,IMAGE_TAG_PATTERN as kE,ImageTagSchema as ZE,ServiceArtefactSchema as jE,ServiceArtefactsSchema as wE,ARTEFACT_OUTPUT_FIELDS as zE,artefactOutputKey as QE}from"./infra/deployArtefacts.js";import{MIGRATION_SNAPSHOT_NAME_PREFIX as JE,EXPECTED_SCHEMA_VERSION_ENV as $E,EXPECTED_SCHEMA_VERSION_TOOL_ENV as er,EXPECTED_CH_SCHEMA_VERSION_ENV as Er,SCHEMA_ADMIN_USER_ENV as rr,SCHEMA_ADMIN_PASSWORD_ENV as tr,PRISMA_MIGRATION_DIR_RE as or,CLICKHOUSE_MIGRATION_SKIP_RE as _r}from"./migration/constants.js";import{PHYSICAL_NAME_FALLBACK_PROPERTIES as Ar}from"./cfn/physicalNameProperties.js";import{PATTERN_TYPE_VALUES as Tr,PATTERN_TYPES as ir,isPatternType as nr,PATTERN_REGISTRY as Rr,DEPLOYABLE_PATTERN_TYPES as Nr,OPENNEXT_PATTERN_TYPES as mr,isOpenNextPatternType as Or,STATIC_SITE_ROUTING_VALUES as Pr}from"./patterns/patternTypes.js";import{DEFAULT_FORMS_FROM_LOCAL_PART as sr,defaultFormsFromAddress as pr,defaultFormsCorsOrigin as cr,isAddressAtDomain as Ir}from"./patterns/staticSiteForms.js";import{DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION as fr,DEV_SUBSTRATE_PARAMS_FILENAME as Mr,DevSubstrateSynthPropsSchema as Lr,DevSubstrateParamsSchema as lr}from"./devSubstrate/params.js";import{DEV_SUBSTRATE_ENTRYPOINT_SOURCE as ur}from"./devSubstrate/entrypoint.js";import{DEPLOYMENT_FAILURE_PHASES as Ur,DeploymentFailurePhaseSchema as xr,DEPLOYMENT_FAULT_ATTRIBUTIONS as Fr,DeploymentFaultAttributionSchema as hr,DEPLOYMENT_FAILURE_PROVIDER_SOURCES as Vr,DeploymentFailureProviderSourceSchema as yr,DEPLOYMENT_FAILURE_CODE_PATTERN as Yr,DEPLOYMENT_FAILURE_SCHEMA_VERSION as Gr,DEPLOYMENT_FAILURE_LIMITS as vr,DeploymentFailureAnalysisSchema as Hr,DeploymentFailureProviderSchema as br,DeploymentFailureResourceSchema as Xr,DeploymentFailureSchema as Kr,parseDeploymentFailure as Br,DEPLOYMENT_FAILURE_DOCS_BASE_URL as Wr,deploymentFailureDocsUrl as kr,DEPLOYMENT_FAULT_COPY as Zr,DEPLOYMENT_PROVIDER_LABELS as jr,deriveErrorMessageFromFailure as wr,toDeploymentFailureAnalysis as zr}from"./failure/deploymentFailure.js";import{extractErrorWindow as qr,ERROR_WINDOW_CONTEXT_LINES as Jr}from"./failure/extractErrorWindow.js";export{Fe as ACCOUNT_ROLES,pe as ACCOUNT_STAGES,Ce as ACCOUNT_STAGES_WITH_ROOT,ce as ACCOUNT_STAGE_LABELS,De as ACCOUNT_TIERS,n as APPROVAL_TOKEN_OUTPUT_PREFIX,zE as ARTEFACT_OUTPUT_FIELDS,Ke as AWS_REGIONS_METADATA,fe as AccountTierSchema,T as BACKUP_VAULT_NAME,y as CAPACITY_ANCHOR_MAX_LENGTH,V as CAPACITY_ANCHOR_PATTERN,Y as CAPACITY_IDENTITY_CONTEXT_KEY,F as CAPACITY_SLOT_MAX_LENGTH,x as CAPACITY_SLOT_PATTERN,_r as CLICKHOUSE_MIGRATION_SKIP_RE,XE as CONTENT_HASH_TAG_PATTERN,H as CapacityIdentityConfigSchema,G as CapacityIdentityPinSchema,v as CapacityIdentityWireSchema,OE as ConnectionWireSchema,PE as ConnectionsListResponseSchema,_e as DANGEROUS_ENV_VARS,h as DEFAULT_CAPACITY_SLOT,sr as DEFAULT_FORMS_FROM_LOCAL_PART,Be as DEFAULT_REGION,Nr as DEPLOYABLE_PATTERN_TYPES,Yr as DEPLOYMENT_FAILURE_CODE_PATTERN,Wr as DEPLOYMENT_FAILURE_DOCS_BASE_URL,vr as DEPLOYMENT_FAILURE_LIMITS,Ur as DEPLOYMENT_FAILURE_PHASES,Vr as DEPLOYMENT_FAILURE_PROVIDER_SOURCES,Gr as DEPLOYMENT_FAILURE_SCHEMA_VERSION,Fr as DEPLOYMENT_FAULT_ATTRIBUTIONS,Zr as DEPLOYMENT_FAULT_COPY,jr as DEPLOYMENT_PROVIDER_LABELS,BE as DEPLOY_MODES,ur as DEV_SUBSTRATE_ENTRYPOINT_SOURCE,Mr as DEV_SUBSTRATE_PARAMS_FILENAME,fr as DEV_SUBSTRATE_PARAMS_SCHEMA_VERSION,r as DNS_APEX,A as DOMAIN_DEPLOY_DEFAULT_PHASE,WE as DeployModeSchema,Hr as DeploymentFailureAnalysisSchema,xr as DeploymentFailurePhaseSchema,br as DeploymentFailureProviderSchema,yr as DeploymentFailureProviderSourceSchema,Xr as DeploymentFailureResourceSchema,Kr as DeploymentFailureSchema,hr as DeploymentFaultAttributionSchema,lr as DevSubstrateParamsSchema,Lr as DevSubstrateSynthPropsSchema,Jr as ERROR_WINDOW_CONTEXT_LINES,Er as EXPECTED_CH_SCHEMA_VERSION_ENV,$E as EXPECTED_SCHEMA_VERSION_ENV,er as EXPECTED_SCHEMA_VERSION_TOOL_ENV,Le as GOVERNANCE_ACCOUNT_TIERS,eE as GOVERNANCE_SCOPE_REQUIRED_CODE,kE as IMAGE_TAG_PATTERN,ZE as ImageTagSchema,Je as MACHINE_ONLY_SCOPES,Ae as MASKED_VALUE_MARKER,ke as MAX_SECONDARY_REGIONS,JE as MIGRATION_SNAPSHOT_NAME_PREFIX,mr as OPENNEXT_PATTERN_TYPES,Ze as OPT_IN_REGION_CODES,Rr as PATTERN_REGISTRY,ir as PATTERN_TYPES,Tr as PATTERN_TYPE_VALUES,Ar as PHYSICAL_NAME_FALLBACK_PROPERTIES,or as PRISMA_MIGRATION_DIR_RE,ie as REDACTED_KEY_SENTINEL,Z as REGION_SHORT_CODES,hE as RESERVED_APP_NAMES,VE as RESERVED_APP_NAME_MESSAGE,YE as RESERVED_APP_NAME_SUFFIX,GE as RESERVED_APP_NAME_SUFFIX_MESSAGE,Ve as RESOURCE_CATEGORIES,tr as SCHEMA_ADMIN_PASSWORD_ENV,rr as SCHEMA_ADMIN_USER_ENV,ne as SCOPED_TOKEN_REGEX,qe as SCOPE_VALUES,tE as SECRET_NAME_ERROR,rE as SECRET_NAME_PATTERN,_E as SSM_COMPONENT_ERROR,oE as SSM_COMPONENT_PATTERN,aE as SSM_STANDARD_MAX_VALUE_BYTES,Pr as STATIC_SITE_ROUTING_VALUES,se as STRUCTURAL_ENVIRONMENTS,AE as SecretNamespaceSchema,jE as ServiceArtefactSchema,wE as ServiceArtefactsSchema,R as TOKEN_STDERR_PREFIX,$e as USER_GRANTABLE_SCOPES,Xe as abbreviateRegion,D as accountConstructKey,de as accountTier,L as albDnsExportName,l as albHostedZoneIdExportName,QE as artefactOutputKey,u as bucketWebsiteEndpointExportName,d as bucketWebsiteHostedZoneIdExportName,LE as buildAppConfigPath,SE as buildNamespaceParts,TE as buildParameterPath,c as capitalise,ye as categoriseResource,g as cdnDomainExportName,W as defaultConnectedAccountName,cr as defaultFormsCorsOrigin,pr as defaultFormsFromAddress,kr as deploymentFailureDocsUrl,cE as deriveAllTargets,bE as deriveContentHashTag,wr as deriveErrorMessageFromFailure,sE as deriveRegionsFromOrgConfig,pE as deriveTargets,IE as environmentOrTier,ge as environmentToTier,NE as escapeDotEnvValue,qr as extractErrorWindow,ae as filterDangerousEnvVars,K as findAccountNameCollision,uE as findBoundaryPath,gE as findInfrastructurePaths,DE as findTarget,j as findTrailingRegionShortCode,Ee as formatErrorString,fE as generateTargetName,t as getDomainExportNames,o as getDomainStackName,_ as getDomainUsEast1CertificatesStackName,xe as getEnvironmentLabel,$ as getErrorCode,q as getErrorMessage,ee as getErrorStack,Ye as getExpectedDuration,Ge as getFriendlyResourceType,We as getRegionInfo,I as getSafeZoneName,f as hasAsciiStableConstructKey,J as hasErrorCode,vE as hasReservedAppNameSuffix,m as imageTagParameterName,xE as inferContainerFromCandidates,Ie as isAccountStage,Me as isAccountTier,Ir as isAddressAtDomain,le as isGovernanceTier,dE as isInfrastructureFile,nE as isManageablePath,a as isManagedDomainBinding,Or as isOpenNextPatternType,nr as isPatternType,yE as isReservedAppName,Oe as mapSettledWithConcurrency,Se as maskSensitiveOutput,Q as normaliseError,je as optInRegionWarning,Br as parseDeploymentFailure,RE as parseDotEnv,He as parseGitRemoteUrl,iE as parseParameterPath,Te as parseShellArgs,b as projectCapacityIdentityToTarget,w as regionSuffixRejectionMessage,we as regions,Ue as resolveSynthEnvironment,te as singleton,Ne as sleep,ue as stageFromWireEnvironment,k as suffixedAccountName,ze as suggestRegionForTimezone,zr as toDeploymentFailureAnalysis,C as toKebab,P as toPascalCase,p as toScreamingSnake,s as toValidDatabaseName};

package/dist/manifest/index.d.ts

@@ -7,4 +7,4 @@
  * the barrel — the package.json `exports` map exposes both subpaths.
  */
 export { DockerBuildSchema, DockerBuildArgValueSchema, DockerBuildSecretRefSchema, DockerBuildPartialSchema, mergeDockerBuild, ManifestServiceSchema, ManifestPatternSchema, ManifestEcrSchema, ManifestLambdaSchema, ManifestStackHashSchema, ResourceMapEntrySchema, FjallManifestSchema, EngineCompatSchema, ManifestCapacityAliasSchema, FJALL_MANIFEST_FILENAME, MANIFEST_SCHEMA_VERSION, MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION, BUILDKIT_SECRET_ID_PATTERN, type DockerBuild, type DockerBuildArgValue, type DockerBuildSecretRef, type DockerBuildPartial, type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ResourceMapEntry, type FjallManifest, type EngineCompat, type ManifestCapacityAlias } from "./schemas.js";
-export { getManifestFilePath, readManifestFile, readManifestFileOutcome, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, readEngineCompatEnvelope, readManifestAppName, readManifestAppNameOutcome, type ManifestAppNameOutcome, type ManifestDockerService, type ManifestFileReadOutcome, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations, type EngineCompatEnvelope } from "./io.js";
+export { getManifestFilePath, readManifestFile, readManifestFileOutcome, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, parseSchemaGateImageTagsFromManifest, type SchemaGateTagsOutcome, readEngineCompatEnvelope, readManifestAppName, readManifestAppNameOutcome, type ManifestAppNameOutcome, type ManifestDockerService, type ManifestFileReadOutcome, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations, type EngineCompatEnvelope } from "./io.js";

package/dist/manifest/index.js

@@ -1 +1 @@
-import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as i,DockerBuildPartialSchema as c,mergeDockerBuild as m,ManifestServiceSchema as s,ManifestPatternSchema as n,ManifestEcrSchema as M,ManifestLambdaSchema as S,ManifestStackHashSchema as o,ResourceMapEntrySchema as f,FjallManifestSchema as E,EngineCompatSchema as p,ManifestCapacityAliasSchema as l,FJALL_MANIFEST_FILENAME as h,MANIFEST_SCHEMA_VERSION as d,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as F,BUILDKIT_SECRET_ID_PATTERN as A}from"./schemas.js";import{getManifestFilePath as _,readManifestFile as k,readManifestFileOutcome as u,writeManifestFile as I,createEmptyManifest as N,readConstructMap as T,parseDockerServicesFromManifest as C,parseLambdaDockerServicesFromManifest as L,parseLambdaDockerEntriesFromManifest as R,parseDockerDeclarationsFromManifest as B,readEngineCompatEnvelope as P,readManifestAppName as g,readManifestAppNameOutcome as O}from"./io.js";export{A as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,c as DockerBuildPartialSchema,r as DockerBuildSchema,i as DockerBuildSecretRefSchema,p as EngineCompatSchema,h as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,d as MANIFEST_SCHEMA_VERSION,F as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,l as ManifestCapacityAliasSchema,M as ManifestEcrSchema,S as ManifestLambdaSchema,n as ManifestPatternSchema,s as ManifestServiceSchema,o as ManifestStackHashSchema,f as ResourceMapEntrySchema,N as createEmptyManifest,_ as getManifestFilePath,m as mergeDockerBuild,B as parseDockerDeclarationsFromManifest,C as parseDockerServicesFromManifest,R as parseLambdaDockerEntriesFromManifest,L as parseLambdaDockerServicesFromManifest,T as readConstructMap,P as readEngineCompatEnvelope,g as readManifestAppName,O as readManifestAppNameOutcome,k as readManifestFile,u as readManifestFileOutcome,I as writeManifestFile};
+import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as i,DockerBuildPartialSchema as c,mergeDockerBuild as m,ManifestServiceSchema as s,ManifestPatternSchema as n,ManifestEcrSchema as M,ManifestLambdaSchema as S,ManifestStackHashSchema as o,ResourceMapEntrySchema as f,FjallManifestSchema as E,EngineCompatSchema as p,ManifestCapacityAliasSchema as h,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as F,MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION as d,BUILDKIT_SECRET_ID_PATTERN as A}from"./schemas.js";import{getManifestFilePath as _,readManifestFile as k,readManifestFileOutcome as u,writeManifestFile as I,createEmptyManifest as N,readConstructMap as T,parseDockerServicesFromManifest as g,parseLambdaDockerServicesFromManifest as C,parseLambdaDockerEntriesFromManifest as L,parseDockerDeclarationsFromManifest as R,parseSchemaGateImageTagsFromManifest as B,readEngineCompatEnvelope as P,readManifestAppName as O,readManifestAppNameOutcome as v}from"./io.js";export{A as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,c as DockerBuildPartialSchema,r as DockerBuildSchema,i as DockerBuildSecretRefSchema,p as EngineCompatSchema,l as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,F as MANIFEST_SCHEMA_VERSION,d as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,h as ManifestCapacityAliasSchema,M as ManifestEcrSchema,S as ManifestLambdaSchema,n as ManifestPatternSchema,s as ManifestServiceSchema,o as ManifestStackHashSchema,f as ResourceMapEntrySchema,N as createEmptyManifest,_ as getManifestFilePath,m as mergeDockerBuild,R as parseDockerDeclarationsFromManifest,g as parseDockerServicesFromManifest,L as parseLambdaDockerEntriesFromManifest,C as parseLambdaDockerServicesFromManifest,B as parseSchemaGateImageTagsFromManifest,T as readConstructMap,P as readEngineCompatEnvelope,O as readManifestAppName,v as readManifestAppNameOutcome,k as readManifestFile,u as readManifestFileOutcome,I as writeManifestFile};

package/dist/manifest/io.d.ts

@@ -242,3 +242,35 @@ export interface ManifestDockerDeclarations {
  * malformed manifest.
  */
 export declare function parseDockerDeclarationsFromManifest(cdkOutPath: string): ManifestDockerDeclarations;
+/**
+ * Outcome of a schema-gate tag extraction. `"ok"` with `tags: []` means the
+ * assembly positively declares no default-image gates (absent manifest —
+ * pre-gate constructs — or no service entry carrying a tag); the pre-flight
+ * may proceed without mirroring. `"manifest-unreadable"` means the manifest
+ * EXISTS but cannot be trusted (unreadable, invalid JSON, malformed
+ * `services`, or an invalid tag value) — the assembly may declare gates this
+ * reader cannot see, so the fail-closed pre-flight must refuse rather than
+ * ship a task definition referencing an unmirrored image.
+ */
+export type SchemaGateTagsOutcome = {
+    outcome: "ok";
+    tags: string[];
+} | {
+    outcome: "manifest-unreadable";
+    reason: string;
+};
+/**
+ * Collect the distinct schema-gate image tags declared by the manifest's
+ * services, sorted for determinism. A service entry carries
+ * `schemaGateImageTag` only when the construct materialised the gate
+ * container with the DEFAULT image (a BYO `schemaGate.image` records
+ * nothing — its availability is the author's responsibility). The deploy
+ * engine must ensure `fjall/schema-gate:<tag>` exists in the target
+ * account's private ECR before any task definition referencing it ships.
+ *
+ * Unlike the sibling `parse*FromManifest` extractors (best-effort readers
+ * feeding advisory surfaces), this feeds a fail-closed deploy gate, so it
+ * distinguishes genuine absence from a failed read instead of collapsing
+ * both to "nothing declared". Never throws.
+ */
+export declare function parseSchemaGateImageTagsFromManifest(cdkOutPath: string): SchemaGateTagsOutcome;

package/dist/manifest/io.js

@@ -1 +1 @@
-var b=Object.defineProperty;var s=(n,e)=>b(n,"name",{value:e,configurable:!0});import{readFile as E,writeFile as k,unlink as F,rename as w,mkdir as x}from"fs/promises";import{readFileSync as g}from"fs";import{dirname as A,join as m}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as N}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as S}from"../constructMap.js";import{FjallManifestSchema as j,FJALL_MANIFEST_FILENAME as p,MANIFEST_SCHEMA_VERSION as C,normaliseDockerBuild as y,LAMBDA_ARCHITECTURE_VALUES as v}from"./schemas.js";function h(n){return m(n,p)}s(h,"getManifestFilePath");async function O(n){const e=h(n);if(!await N(e))return{status:"absent"};try{const r=await E(e,"utf-8"),t=JSON.parse(r),a=j.safeParse(t);if(!a.success){const i=f(a.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:a.data}}catch(r){const t=f(d(r));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(O,"readManifestFileOutcome");async function D(n){const e=await O(n);return e.status==="ok"?e.manifest:null}s(D,"readManifestFile");async function q(n,e){const r=h(n),t=`${r}.${Date.now()}.tmp`;await x(A(r),{recursive:!0});try{await k(t,JSON.stringify(e,null,2),"utf-8"),await w(t,r)}catch(a){try{await F(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw a}}s(q,"writeManifestFile");function z(n){return{version:C,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(z,"createEmptyManifest");async function G(n){const e=await D(n);return e?.resourceMap?S(e.resourceMap):new Map}s(G,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function l(n,e){const r=m(n,p);let t;try{t=g(r,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:r});return}let a;try{a=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:r});return}return u(a)?a:void 0}s(l,"readManifestRecord");function L(n){const e=n.engineCompat;if(!u(e))return;const r=e.minimumEngineVersion;if(typeof r!="string"||r.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",a=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:r,...a!==void 0&&{maximumEngineMajor:a},...o!==void 0&&{minimumAwsCdkCli:o}}}s(L,"extractEngineCompat");function Q(n){const e=l(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const r=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),a=L(e);return{manifestVersion:r,engineCompatPresent:t,engineCompat:a}}s(Q,"readEngineCompatEnvelope");function W(n){const e=I(n);return e.status==="ok"?e.appName:void 0}s(W,"readManifestAppName");function I(n){const e=m(n,p);let r;try{r=g(e,"utf-8")}catch(a){const i=a!==null&&typeof a=="object"&&"code"in a?a.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"})}let t;try{t=JSON.parse(r)}catch(a){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(a))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s(I,"readManifestAppNameOutcome");function J(n){const e=l(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const r=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);a!==void 0&&r.push({name:t.name,docker:a,isLambda:!1})}return r}s(J,"parseDockerServicesFromManifest");function X(n){const e=new Map;for(const{name:r,imageKey:t,docker:a,architecture:i}of M(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:a,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(a)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${r}").`)}return Array.from(e.values())}s(X,"parseLambdaDockerServicesFromManifest");function M(n){const e=l(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const r=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const a=y(t.docker);if(a===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&(v.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),r.push({name:t.name,imageKey:i,docker:a,...o!==void 0&&{architecture:o}})}return r}s(M,"parseLambdaDockerEntriesFromManifest");function Y(n){const e=J(n),r=M(n);return{ecsServices:e,lambdaEntries:r,declaresBuild:e.length>0||r.length>0}}s(Y,"parseDockerDeclarationsFromManifest");export{z as createEmptyManifest,h as getManifestFilePath,Y as parseDockerDeclarationsFromManifest,J as parseDockerServicesFromManifest,M as parseLambdaDockerEntriesFromManifest,X as parseLambdaDockerServicesFromManifest,G as readConstructMap,Q as readEngineCompatEnvelope,W as readManifestAppName,I as readManifestAppNameOutcome,D as readManifestFile,O as readManifestFileOutcome,q as writeManifestFile};
+var M=Object.defineProperty;var s=(n,e)=>M(n,"name",{value:e,configurable:!0});import{readFile as k,writeFile as E,unlink as N,rename as S,mkdir as w}from"fs/promises";import{readFileSync as p}from"fs";import{dirname as F,join as m}from"path";import{logger as c}from"../logger.js";import{maskSensitiveOutput as f}from"../securityHelpers.js";import{fileExists as x}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as A}from"../constructMap.js";import{FjallManifestSchema as v,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as j,normaliseDockerBuild as y,LAMBDA_ARCHITECTURE_VALUES as C}from"./schemas.js";function h(n){return m(n,l)}s(h,"getManifestFilePath");async function O(n){const e=h(n);if(!await x(e))return{status:"absent"};try{const a=await k(e,"utf-8"),t=JSON.parse(a),r=v.safeParse(t);if(!r.success){const i=f(r.error.issues.map(o=>`${o.path.join(".")}: ${o.message}`).join("; "));return c.debug("FjallManifest","Manifest validation failed",{path:e,errors:i}),{status:"unreadable",detail:i}}return{status:"ok",manifest:r.data}}catch(a){const t=f(d(a));return c.debug("FjallManifest","Failed to read manifest file",{path:e,error:t}),{status:"unreadable",detail:t}}}s(O,"readManifestFileOutcome");async function I(n){const e=await O(n);return e.status==="ok"?e.manifest:null}s(I,"readManifestFile");async function U(n,e){const a=h(n),t=`${a}.${Date.now()}.tmp`;await w(F(a),{recursive:!0});try{await E(t,JSON.stringify(e,null,2),"utf-8"),await S(t,a)}catch(r){try{await N(t)}catch(i){c.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(i)})}throw r}}s(U,"writeManifestFile");function q(n){return{version:j,generatedAt:new Date().toISOString(),appName:n,services:[],lambdas:[],stacks:{}}}s(q,"createEmptyManifest");async function z(n){const e=await I(n);return e?.resourceMap?A(e.resourceMap):new Map}s(z,"readConstructMap");function u(n){return typeof n=="object"&&n!==null&&!Array.isArray(n)}s(u,"isRecord");function g(n,e){const a=m(n,l);let t;try{t=p(a,"utf-8")}catch{c.debug("FjallManifest",`Manifest file not readable \u2014 no ${e} extracted`,{path:a});return}let r;try{r=JSON.parse(t)}catch{c.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${e} extracted`,{path:a});return}return u(r)?r:void 0}s(g,"readManifestRecord");function T(n){const e=n.engineCompat;if(!u(e))return;const a=e.minimumEngineVersion;if(typeof a!="string"||a.length===0)return;const t=typeof e.synthesisedBy=="string"&&e.synthesisedBy.length>0?e.synthesisedBy:"",r=typeof e.maximumEngineMajor=="number"&&Number.isInteger(e.maximumEngineMajor)&&e.maximumEngineMajor>=0?e.maximumEngineMajor:void 0,i=e.minimumAwsCdkCli,o=i===void 0?void 0:typeof i=="string"?i:String(i);return{synthesisedBy:t,minimumEngineVersion:a,...r!==void 0&&{maximumEngineMajor:r},...o!==void 0&&{minimumAwsCdkCli:o}}}s(T,"extractEngineCompat");function Q(n){const e=g(n,"engine compatibility");if(e===void 0)return{manifestVersion:void 0,engineCompatPresent:!1,engineCompat:void 0};const a=typeof e.version=="number"?e.version:void 0,t=u(e.engineCompat),r=T(e);return{manifestVersion:a,engineCompatPresent:t,engineCompat:r}}s(Q,"readEngineCompatEnvelope");function W(n){const e=$(n);return e.status==="ok"?e.appName:void 0}s(W,"readManifestAppName");function $(n){const e=m(n,l);let a;try{a=p(e,"utf-8")}catch(r){const i=r!==null&&typeof r=="object"&&"code"in r?r.code:void 0;return i==="ENOENT"||i==="ENOTDIR"?{status:"absent"}:(c.debug("FjallManifest","Manifest file not readable \u2014 no app name",{path:e,error:f(d(r))}),{status:"unreadable"})}let t;try{t=JSON.parse(a)}catch(r){return c.debug("FjallManifest","Manifest is not valid JSON \u2014 no app name",{path:e,error:f(d(r))}),{status:"unreadable"}}return u(t)?{status:"ok",appName:typeof t.appName=="string"&&t.appName!==""?t.appName:void 0}:{status:"unreadable"}}s($,"readManifestAppNameOutcome");function D(n){const e=g(n,"Docker services");if(e===void 0||!Array.isArray(e.services))return[];const a=[];for(const t of e.services){if(!u(t)||typeof t.name!="string")continue;const r=y(t.docker);r!==void 0&&a.push({name:t.name,docker:r,isLambda:!1})}return a}s(D,"parseDockerServicesFromManifest");function X(n){const e=new Map;for(const{name:a,imageKey:t,docker:r,architecture:i}of b(n)){const o=e.get(t);if(o===void 0){e.set(t,{name:t,docker:r,isLambda:!0,...i!==void 0&&{architecture:i}});continue}if(JSON.stringify(o.docker)!==JSON.stringify(r)||o.architecture!==i)throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs or \`architecture\` \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs and target the same architecture (offending function: "${a}").`)}return Array.from(e.values())}s(X,"parseLambdaDockerServicesFromManifest");function b(n){const e=g(n,"Lambda Docker entries");if(e===void 0||!Array.isArray(e.lambdas))return[];const a=[];for(const t of e.lambdas){if(!u(t)||typeof t.name!="string")continue;const r=y(t.docker);if(r===void 0)continue;const i=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;let o;typeof t.architecture=="string"&&(C.includes(t.architecture)?o=t.architecture:c.debug("FjallManifest","Ignoring unrecognised Lambda architecture \u2014 build falls back to the default platform",{lambda:t.name,architecture:f(t.architecture)})),a.push({name:t.name,imageKey:i,docker:r,...o!==void 0&&{architecture:o}})}return a}s(b,"parseLambdaDockerEntriesFromManifest");function Y(n){const e=D(n),a=b(n);return{ecsServices:e,lambdaEntries:a,declaresBuild:e.length>0||a.length>0}}s(Y,"parseDockerDeclarationsFromManifest");function Z(n){const e=m(n,l);let a;try{a=p(e,"utf-8")}catch(i){const o=i.code;return o==="ENOENT"?{outcome:"ok",tags:[]}:{outcome:"manifest-unreadable",reason:`manifest at ${e} exists but could not be read (${o??"unknown error"})`}}let t;try{t=JSON.parse(a)}catch{return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not valid JSON`}}if(!u(t))return{outcome:"manifest-unreadable",reason:`manifest at ${e} is not a JSON object`};if(t.services===void 0)return{outcome:"ok",tags:[]};if(!Array.isArray(t.services))return{outcome:"manifest-unreadable",reason:`manifest at ${e} has a non-array \`services\` field`};const r=new Set;for(const i of t.services)if(u(i)&&i.schemaGateImageTag!==void 0){if(typeof i.schemaGateImageTag!="string"||i.schemaGateImageTag==="")return{outcome:"manifest-unreadable",reason:`manifest at ${e} declares an invalid schemaGateImageTag for service '${typeof i.name=="string"?i.name:"<unnamed>"}'`};r.add(i.schemaGateImageTag)}return{outcome:"ok",tags:[...r].sort()}}s(Z,"parseSchemaGateImageTagsFromManifest");export{q as createEmptyManifest,h as getManifestFilePath,Y as parseDockerDeclarationsFromManifest,D as parseDockerServicesFromManifest,b as parseLambdaDockerEntriesFromManifest,X as parseLambdaDockerServicesFromManifest,Z as parseSchemaGateImageTagsFromManifest,z as readConstructMap,Q as readEngineCompatEnvelope,W as readManifestAppName,$ as readManifestAppNameOutcome,I as readManifestFile,O as readManifestFileOutcome,U as writeManifestFile};

package/dist/manifest/schemas.d.ts

@@ -248,6 +248,7 @@ declare const ManifestServiceSchema: z.ZodObject<{
     secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
     ssmSecretsPath: z.ZodOptional<z.ZodString>;
     importedSecretNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemaGateImageTag: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ManifestService = z.infer<typeof ManifestServiceSchema>;
 declare const ManifestPatternSchema: z.ZodObject<{
@@ -389,6 +390,53 @@ export declare const ManifestCapacityAliasSchema: z.ZodObject<{
     legacyKeyFields: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type ManifestCapacityAlias = z.infer<typeof ManifestCapacityAliasSchema>;
+/**
+ * One residuals-contract entry: a synth site whose resource deliberately
+ * outlives — or is structurally invisible to — CFN stack teardown (a
+ * RETAIN/SNAPSHOT removal policy, or an adopted pre-existing resource).
+ * Emitted at synth so what survives a destroy is known BEFORE any destroy
+ * runs; the destroy lane composes these entries with its own outcomes into
+ * the destroy-time residuals report.
+ *
+ * - `policy` records the RESOLVED value for this synth, never the source
+ *   expression — removal policies are env-aware, and recording the
+ *   expression would hide exactly the env-resolution drift the contract
+ *   exists to surface.
+ * - `destroyDisposition` distinguishes sites the explicit destroy lane
+ *   removes SDK-side (`deleted-on-explicit-destroy`) from sites that
+ *   genuinely survive (`survives`), so the manifest and the destroy-time
+ *   report cannot contradict each other.
+ *
+ * Rollout is two-phase additive (the `engineCompat` precedent): this schema
+ * field lands first; the only v1 emitter is the DevSubstrate construct,
+ * whose synth workspace pins `@fjall/*` to the consuming engine's version —
+ * generic wrapper-level emission follows once the field has propagated to
+ * readers.
+ *
+ * WRITE contract: `.strict()` like `EngineCompatSchema`.
+ */
+export declare const ManifestResidualSchema: z.ZodObject<{
+    constructPath: z.ZodString;
+    resourceType: z.ZodString;
+    physicalNameHint: z.ZodString;
+    policy: z.ZodEnum<{
+        retain: "retain";
+        snapshot: "snapshot";
+        adopted: "adopted";
+    }>;
+    destroyDisposition: z.ZodEnum<{
+        survives: "survives";
+        "deleted-on-explicit-destroy": "deleted-on-explicit-destroy";
+    }>;
+    reason: z.ZodString;
+    costClass: z.ZodEnum<{
+        none: "none";
+        storage: "storage";
+        "fixed-monthly": "fixed-monthly";
+    }>;
+    cleanupHint: z.ZodString;
+}, z.core.$strict>;
+export type ManifestResidual = z.infer<typeof ManifestResidualSchema>;
 /**
  * Fjall manifest schema — generated during CDK synth.
  * Location: `<cdk.out>/fjall-manifest.json`.
@@ -429,6 +477,7 @@ export declare const FjallManifestSchema: z.ZodObject<{
         secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssmSecretsPath: z.ZodOptional<z.ZodString>;
         importedSecretNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        schemaGateImageTag: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     lambdas: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -505,6 +554,27 @@ export declare const FjallManifestSchema: z.ZodObject<{
         legacyServiceName: z.ZodString;
         legacyKeyFields: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>>;
+    residuals: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        constructPath: z.ZodString;
+        resourceType: z.ZodString;
+        physicalNameHint: z.ZodString;
+        policy: z.ZodEnum<{
+            retain: "retain";
+            snapshot: "snapshot";
+            adopted: "adopted";
+        }>;
+        destroyDisposition: z.ZodEnum<{
+            survives: "survives";
+            "deleted-on-explicit-destroy": "deleted-on-explicit-destroy";
+        }>;
+        reason: z.ZodString;
+        costClass: z.ZodEnum<{
+            none: "none";
+            storage: "storage";
+            "fixed-monthly": "fixed-monthly";
+        }>;
+        cleanupHint: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type FjallManifest = z.infer<typeof FjallManifestSchema>;
 export { ManifestServiceSchema, ManifestPatternSchema, ManifestEcrSchema, ManifestLambdaSchema, ManifestStackHashSchema, ResourceMapEntrySchema, EngineCompatSchema };

package/dist/manifest/schemas.js

@@ -1 +1 @@
-var x=Object.defineProperty;var o=(t,n)=>x(t,"name",{value:n,configurable:!0});import{z as e}from"zod";import{PATTERN_TYPE_VALUES as S}from"../patterns/patternTypes.js";const C="fjall-manifest.json",h=1,P=1,A=/^[A-Za-z0-9_.-]+$/,M=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(A,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),E=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),c=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),E).optional(),buildSecrets:e.array(M).optional()}).strict(),R=c.partial();function B(t,n){if(n===void 0)return t;const i=n.context??t.context,r=n.target??t.target,s=n.buildArgs??t.buildArgs,a=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...i!==void 0&&{context:i},...r!==void 0&&{target:r},...s!==void 0&&{buildArgs:s},...a!==void 0&&{buildSecrets:a}}}o(B,"mergeDockerBuild");function d(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}o(d,"isRecord");function j(t){if(!d(t)||typeof t.path!="string"||t.path.length===0)return;const n=typeof t.context=="string"&&t.context.length>0?t.context:void 0,i=typeof t.target=="string"&&t.target.length>0?t.target:void 0,r=d(t.buildArgs)&&Object.keys(t.buildArgs).length>0?t.buildArgs:void 0,s=Array.isArray(t.buildSecrets)&&t.buildSecrets.length>0?t.buildSecrets:void 0,a={path:t.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...s!==void 0&&{buildSecrets:s}},m=c.safeParse(a);return m.success?m.data:void 0}o(j,"normaliseDockerBuild");function D(t){if(t===void 0)return;const n=j(t);return n===void 0?void 0:JSON.stringify(n)}o(D,"dockerBuildFingerprint");const g=e.object({name:e.string(),clusterName:e.string().optional(),docker:c.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),p=e.object({type:e.enum(S),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),N=["x86_64","arm64"],u=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),docker:c.optional(),imageKey:e.string().optional(),architecture:e.enum(N).optional()}).strict(),f=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),b=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),y=e.object({synthesisedBy:e.string().min(1).max(128),minimumEngineVersion:e.string().min(1).max(32),maximumEngineMajor:e.number().int().min(0).optional(),minimumAwsCdkCli:e.string().min(1).max(32).optional()}).strict(),_=e.object({appName:e.string().min(1).max(128),slot:e.string().min(1).max(64),clusterName:e.string().min(1).max(128),anchor:e.string().min(1).max(128),pinned:e.boolean(),currentServiceName:e.string().min(1).max(256),legacyKey:e.string().min(1).max(256),legacyAnchor:e.string().min(1).max(256),legacyServiceName:e.string().min(1).max(512),legacyKeyFields:e.array(e.string().max(64)).max(32)}).strict(),F=e.object({version:e.literal(h),generatedAt:e.string(),appName:e.string(),services:e.array(g),lambdas:e.array(u),pattern:p.optional(),ecr:l.optional(),stacks:e.record(e.string(),f),resourceMap:e.record(e.string(),b).optional(),engineCompat:y.optional(),identityAliases:e.array(_).optional()}).strict();export{A as BUILDKIT_SECRET_ID_PATTERN,E as DockerBuildArgValueSchema,R as DockerBuildPartialSchema,c as DockerBuildSchema,M as DockerBuildSecretRefSchema,y as EngineCompatSchema,C as FJALL_MANIFEST_FILENAME,F as FjallManifestSchema,N as LAMBDA_ARCHITECTURE_VALUES,h as MANIFEST_SCHEMA_VERSION,P as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,_ as ManifestCapacityAliasSchema,l as ManifestEcrSchema,u as ManifestLambdaSchema,p as ManifestPatternSchema,g as ManifestServiceSchema,f as ManifestStackHashSchema,b as ResourceMapEntrySchema,D as dockerBuildFingerprint,B as mergeDockerBuild,j as normaliseDockerBuild};
+var x=Object.defineProperty;var a=(t,n)=>x(t,"name",{value:n,configurable:!0});import{z as e}from"zod";import{PATTERN_TYPE_VALUES as h}from"../patterns/patternTypes.js";const P="fjall-manifest.json",S=1,R=1,A=/^[A-Za-z0-9_.-]+$/,M=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(A,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),E=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),c=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),E).optional(),buildSecrets:e.array(M).optional()}).strict(),B=c.partial();function D(t,n){if(n===void 0)return t;const i=n.context??t.context,r=n.target??t.target,s=n.buildArgs??t.buildArgs,o=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...i!==void 0&&{context:i},...r!==void 0&&{target:r},...s!==void 0&&{buildArgs:s},...o!==void 0&&{buildSecrets:o}}}a(D,"mergeDockerBuild");function d(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}a(d,"isRecord");function j(t){if(!d(t)||typeof t.path!="string"||t.path.length===0)return;const n=typeof t.context=="string"&&t.context.length>0?t.context:void 0,i=typeof t.target=="string"&&t.target.length>0?t.target:void 0,r=d(t.buildArgs)&&Object.keys(t.buildArgs).length>0?t.buildArgs:void 0,s=Array.isArray(t.buildSecrets)&&t.buildSecrets.length>0?t.buildSecrets:void 0,o={path:t.path,...n!==void 0&&{context:n},...i!==void 0&&{target:i},...r!==void 0&&{buildArgs:r},...s!==void 0&&{buildSecrets:s}},m=c.safeParse(o);return m.success?m.data:void 0}a(j,"normaliseDockerBuild");function F(t){if(t===void 0)return;const n=j(t);return n===void 0?void 0:JSON.stringify(n)}a(F,"dockerBuildFingerprint");const g=e.object({name:e.string(),clusterName:e.string().optional(),docker:c.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),schemaGateImageTag:e.string().optional()}).strict(),p=e.object({type:e.enum(h),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),N=["x86_64","arm64"],u=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),docker:c.optional(),imageKey:e.string().optional(),architecture:e.enum(N).optional()}).strict(),f=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),b=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),y=e.object({synthesisedBy:e.string().min(1).max(128),minimumEngineVersion:e.string().min(1).max(32),maximumEngineMajor:e.number().int().min(0).optional(),minimumAwsCdkCli:e.string().min(1).max(32).optional()}).strict(),T=e.object({appName:e.string().min(1).max(128),slot:e.string().min(1).max(64),clusterName:e.string().min(1).max(128),anchor:e.string().min(1).max(128),pinned:e.boolean(),currentServiceName:e.string().min(1).max(256),legacyKey:e.string().min(1).max(256),legacyAnchor:e.string().min(1).max(256),legacyServiceName:e.string().min(1).max(512),legacyKeyFields:e.array(e.string().max(64)).max(32)}).strict(),_=e.object({constructPath:e.string().min(1).max(512),resourceType:e.string().min(1).max(256),physicalNameHint:e.string().min(1).max(512),policy:e.enum(["retain","snapshot","adopted"]),destroyDisposition:e.enum(["survives","deleted-on-explicit-destroy"]),reason:e.string().min(1).max(1024),costClass:e.enum(["none","storage","fixed-monthly"]),cleanupHint:e.string().min(1).max(1024)}).strict(),L=e.object({version:e.literal(S),generatedAt:e.string(),appName:e.string(),services:e.array(g),lambdas:e.array(u),pattern:p.optional(),ecr:l.optional(),stacks:e.record(e.string(),f),resourceMap:e.record(e.string(),b).optional(),engineCompat:y.optional(),identityAliases:e.array(T).optional(),residuals:e.array(_).optional()}).strict();export{A as BUILDKIT_SECRET_ID_PATTERN,E as DockerBuildArgValueSchema,B as DockerBuildPartialSchema,c as DockerBuildSchema,M as DockerBuildSecretRefSchema,y as EngineCompatSchema,P as FJALL_MANIFEST_FILENAME,L as FjallManifestSchema,N as LAMBDA_ARCHITECTURE_VALUES,S as MANIFEST_SCHEMA_VERSION,R as MAX_SUPPORTED_MANIFEST_SCHEMA_VERSION,T as ManifestCapacityAliasSchema,l as ManifestEcrSchema,u as ManifestLambdaSchema,p as ManifestPatternSchema,_ as ManifestResidualSchema,g as ManifestServiceSchema,f as ManifestStackHashSchema,b as ResourceMapEntrySchema,F as dockerBuildFingerprint,D as mergeDockerBuild,j as normaliseDockerBuild};

package/dist/migration/constants.d.ts

@@ -46,6 +46,58 @@ export declare const EXPECTED_CH_SCHEMA_VERSION_ENV: "EXPECTED_CH_SCHEMA_VERSION
  */
 export declare const SCHEMA_ADMIN_USER_ENV: "SCHEMA_ADMIN_USER";
 export declare const SCHEMA_ADMIN_PASSWORD_ENV: "SCHEMA_ADMIN_PASSWORD";
+/**
+ * Container env / secret names for the materialised schema-gate container
+ * (`@fjall/schema-gate`). Injected ONLY into the synthetic `fjall-schema-gate`
+ * container by `EcsCompute` (never into app containers — those keep their own
+ * connection wiring), read by the gate runner at boot. Coupled values across
+ * the construct↔runner package boundary — both sides import these names so a
+ * rename cannot leave the construct injecting an env the runner no longer
+ * reads (which would surface as exit 2 on every deploy, a wedge class).
+ *
+ * `SCHEMA_GATE_DB_URL_BASE_ENV` carries `getConnectionString()` output —
+ * `<scheme>://<host>:<port>/<dbname>` WITHOUT credentials (SecretValue
+ * references cannot be interpolated at synth). The runner composes the final
+ * URL from the two Secrets-Manager-backed sibling envs.
+ */
+export declare const SCHEMA_GATE_DB_URL_BASE_ENV: "FJALL_SCHEMA_GATE_DB_URL_BASE";
+export declare const SCHEMA_GATE_DB_USER_ENV: "FJALL_SCHEMA_GATE_DB_USER";
+export declare const SCHEMA_GATE_DB_PASSWORD_ENV: "FJALL_SCHEMA_GATE_DB_PASSWORD";
+/**
+ * ClickHouse connection env names for the materialised gate container's CH
+ * half. Coupled values across the construct↔runner boundary like the
+ * `SCHEMA_GATE_DB_*` trio above: `EcsCompute` composes `CLICKHOUSE_URL` /
+ * `CLICKHOUSE_DATABASE` from the resolved CH database (plus the CA-cert
+ * secret import when the database is TLS-fronted) and the gate runner reads
+ * the same names at boot. The values are the conventional names app
+ * containers already receive from connection wiring — the constants pin the
+ * gate contract, they do not rename anything.
+ */
+export declare const SCHEMA_GATE_CH_URL_ENV: "CLICKHOUSE_URL";
+export declare const SCHEMA_GATE_CH_DATABASE_ENV: "CLICKHOUSE_DATABASE";
+export declare const SCHEMA_GATE_CH_CA_CERT_ENV: "CLICKHOUSE_CA_CERT";
+/**
+ * The synthetic gate container's reserved name. Shared between the construct
+ * (container synthesis + the name-collision validator in `validateEcsProps`)
+ * and anything that needs to address the container (deploy-time diagnostics,
+ * docs examples). Coupled values — a drift renders the collision validator
+ * guarding a name the synthesiser no longer emits.
+ */
+export declare const SCHEMA_GATE_CONTAINER_NAME: "fjall-schema-gate";
+/**
+ * ECR repository names for the gate runner's OCI image. Coupled values across
+ * the construct↔deploy-engine boundary (Code Quality § "Runtime resource names
+ * must match the CDK construct's derivation"): `EcsCompute` composes the
+ * default container image URI as
+ * `<account>.dkr.ecr.<region>.<urlSuffix>/${SCHEMA_GATE_ECR_REPO_NAME}:<exact semver>`
+ * while deploy-core's `ensureSchemaGateImage` creates that private repository
+ * and mirrors the matching tag into it from `SCHEMA_GATE_PUBLIC_IMAGE_REPO`.
+ * The image tag is ALWAYS the exact `@fjall/schema-gate` package semver
+ * (lockstep-versioned with the constructs), never `latest` — a construct
+ * upgrade must not silently change gate behaviour on redeploys.
+ */
+export declare const SCHEMA_GATE_ECR_REPO_NAME: "fjall/schema-gate";
+export declare const SCHEMA_GATE_PUBLIC_IMAGE_REPO: "public.ecr.aws/fjall/schema-gate";
 /**
  * Prisma migration directory pattern: 14-digit timestamp + underscore prefix.
  * Sortable alphanumerically because the timestamp is fixed-width.

package/dist/migration/constants.js

@@ -1 +1 @@
-const E="fjall-premigrate",_="EXPECTED_SCHEMA_VERSION",S="EXPECTED_SCHEMA_VERSION_TOOL",I="EXPECTED_CH_SCHEMA_VERSION",A="SCHEMA_ADMIN_USER",C="SCHEMA_ADMIN_PASSWORD",N=/^\d{14}_/,M=/\.dev\.sql$/,R=/\.sql$/;export{R as CLICKHOUSE_MIGRATION_FILE_RE,M as CLICKHOUSE_MIGRATION_SKIP_RE,I as EXPECTED_CH_SCHEMA_VERSION_ENV,_ as EXPECTED_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E as MIGRATION_SNAPSHOT_NAME_PREFIX,N as PRISMA_MIGRATION_DIR_RE,C as SCHEMA_ADMIN_PASSWORD_ENV,A as SCHEMA_ADMIN_USER_ENV};
+const E="fjall-premigrate",_="EXPECTED_SCHEMA_VERSION",A="EXPECTED_SCHEMA_VERSION_TOOL",S="EXPECTED_CH_SCHEMA_VERSION",C="SCHEMA_ADMIN_USER",t="SCHEMA_ADMIN_PASSWORD",o="FJALL_SCHEMA_GATE_DB_URL_BASE",M="FJALL_SCHEMA_GATE_DB_USER",R="FJALL_SCHEMA_GATE_DB_PASSWORD",H="CLICKHOUSE_URL",I="CLICKHOUSE_DATABASE",N="CLICKHOUSE_CA_CERT",T="fjall-schema-gate",e="fjall/schema-gate",O="public.ecr.aws/fjall/schema-gate",s=/^\d{14}_/,c=/\.dev\.sql$/,D=/\.sql$/;export{D as CLICKHOUSE_MIGRATION_FILE_RE,c as CLICKHOUSE_MIGRATION_SKIP_RE,S as EXPECTED_CH_SCHEMA_VERSION_ENV,_ as EXPECTED_SCHEMA_VERSION_ENV,A as EXPECTED_SCHEMA_VERSION_TOOL_ENV,E as MIGRATION_SNAPSHOT_NAME_PREFIX,s as PRISMA_MIGRATION_DIR_RE,t as SCHEMA_ADMIN_PASSWORD_ENV,C as SCHEMA_ADMIN_USER_ENV,N as SCHEMA_GATE_CH_CA_CERT_ENV,I as SCHEMA_GATE_CH_DATABASE_ENV,H as SCHEMA_GATE_CH_URL_ENV,T as SCHEMA_GATE_CONTAINER_NAME,R as SCHEMA_GATE_DB_PASSWORD_ENV,o as SCHEMA_GATE_DB_URL_BASE_ENV,M as SCHEMA_GATE_DB_USER_ENV,e as SCHEMA_GATE_ECR_REPO_NAME,O as SCHEMA_GATE_PUBLIC_IMAGE_REPO};

package/dist/migration/index.d.ts

@@ -1,4 +1,4 @@
-export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./constants.js";
+export { MIGRATION_SNAPSHOT_NAME_PREFIX, EXPECTED_SCHEMA_VERSION_ENV, EXPECTED_SCHEMA_VERSION_TOOL_ENV, EXPECTED_CH_SCHEMA_VERSION_ENV, SCHEMA_ADMIN_USER_ENV, SCHEMA_ADMIN_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV, SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_CH_URL_ENV, SCHEMA_GATE_CH_DATABASE_ENV, SCHEMA_GATE_CH_CA_CERT_ENV, SCHEMA_GATE_CONTAINER_NAME, SCHEMA_GATE_ECR_REPO_NAME, SCHEMA_GATE_PUBLIC_IMAGE_REPO, PRISMA_MIGRATION_DIR_RE, CLICKHOUSE_MIGRATION_SKIP_RE } from "./constants.js";
 export { pickLatestPrismaMigration } from "./pickLatestPrismaMigration.js";
 export { pickLatestClickHouseMigration } from "./pickLatestClickHouseMigration.js";
 export { isOrderableSchemaVersion, isSchemaVersionSatisfied } from "./compareSchemaVersion.js";

package/dist/migration/index.js

@@ -1 +1 @@
-import{MIGRATION_SNAPSHOT_NAME_PREFIX as e,EXPECTED_SCHEMA_VERSION_ENV as S,EXPECTED_SCHEMA_VERSION_TOOL_ENV as r,EXPECTED_CH_SCHEMA_VERSION_ENV as N,SCHEMA_ADMIN_USER_ENV as a,SCHEMA_ADMIN_PASSWORD_ENV as A,PRISMA_MIGRATION_DIR_RE as o,CLICKHOUSE_MIGRATION_SKIP_RE as M}from"./constants.js";import{pickLatestPrismaMigration as i}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as R}from"./pickLatestClickHouseMigration.js";import{isOrderableSchemaVersion as t,isSchemaVersionSatisfied as C}from"./compareSchemaVersion.js";import{verifyExpectedSchemaVersion as V}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as H,MANAGED_USER_NAME_PATTERN as T,userPasswordEnvName as c,ManagedUserNameSchema as p,ManagedUserNamesSchema as D}from"./clickhouseSqlUsers.js";export{H as CLICKHOUSE_MANAGED_USERS_ENV,M as CLICKHOUSE_MIGRATION_SKIP_RE,N as EXPECTED_CH_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_ENV,r as EXPECTED_SCHEMA_VERSION_TOOL_ENV,T as MANAGED_USER_NAME_PATTERN,e as MIGRATION_SNAPSHOT_NAME_PREFIX,p as ManagedUserNameSchema,D as ManagedUserNamesSchema,o as PRISMA_MIGRATION_DIR_RE,A as SCHEMA_ADMIN_PASSWORD_ENV,a as SCHEMA_ADMIN_USER_ENV,t as isOrderableSchemaVersion,C as isSchemaVersionSatisfied,R as pickLatestClickHouseMigration,i as pickLatestPrismaMigration,c as userPasswordEnvName,V as verifyExpectedSchemaVersion};
+import{MIGRATION_SNAPSHOT_NAME_PREFIX as A,EXPECTED_SCHEMA_VERSION_ENV as S,EXPECTED_SCHEMA_VERSION_TOOL_ENV as N,EXPECTED_CH_SCHEMA_VERSION_ENV as e,SCHEMA_ADMIN_USER_ENV as C,SCHEMA_ADMIN_PASSWORD_ENV as M,SCHEMA_GATE_DB_URL_BASE_ENV as r,SCHEMA_GATE_DB_USER_ENV as R,SCHEMA_GATE_DB_PASSWORD_ENV as H,SCHEMA_GATE_CH_URL_ENV as T,SCHEMA_GATE_CH_DATABASE_ENV as a,SCHEMA_GATE_CH_CA_CERT_ENV as I,SCHEMA_GATE_CONTAINER_NAME as o,SCHEMA_GATE_ECR_REPO_NAME as V,SCHEMA_GATE_PUBLIC_IMAGE_REPO as O,PRISMA_MIGRATION_DIR_RE as i,CLICKHOUSE_MIGRATION_SKIP_RE as s}from"./constants.js";import{pickLatestPrismaMigration as G}from"./pickLatestPrismaMigration.js";import{pickLatestClickHouseMigration as t}from"./pickLatestClickHouseMigration.js";import{isOrderableSchemaVersion as U,isSchemaVersionSatisfied as c}from"./compareSchemaVersion.js";import{verifyExpectedSchemaVersion as f}from"./verifyExpectedSchemaVersion.js";import{CLICKHOUSE_MANAGED_USERS_ENV as L,MANAGED_USER_NAME_PATTERN as x,userPasswordEnvName as d,ManagedUserNameSchema as B,ManagedUserNamesSchema as h}from"./clickhouseSqlUsers.js";export{L as CLICKHOUSE_MANAGED_USERS_ENV,s as CLICKHOUSE_MIGRATION_SKIP_RE,e as EXPECTED_CH_SCHEMA_VERSION_ENV,S as EXPECTED_SCHEMA_VERSION_ENV,N as EXPECTED_SCHEMA_VERSION_TOOL_ENV,x as MANAGED_USER_NAME_PATTERN,A as MIGRATION_SNAPSHOT_NAME_PREFIX,B as ManagedUserNameSchema,h as ManagedUserNamesSchema,i as PRISMA_MIGRATION_DIR_RE,M as SCHEMA_ADMIN_PASSWORD_ENV,C as SCHEMA_ADMIN_USER_ENV,I as SCHEMA_GATE_CH_CA_CERT_ENV,a as SCHEMA_GATE_CH_DATABASE_ENV,T as SCHEMA_GATE_CH_URL_ENV,o as SCHEMA_GATE_CONTAINER_NAME,H as SCHEMA_GATE_DB_PASSWORD_ENV,r as SCHEMA_GATE_DB_URL_BASE_ENV,R as SCHEMA_GATE_DB_USER_ENV,V as SCHEMA_GATE_ECR_REPO_NAME,O as SCHEMA_GATE_PUBLIC_IMAGE_REPO,U as isOrderableSchemaVersion,c as isSchemaVersionSatisfied,t as pickLatestClickHouseMigration,G as pickLatestPrismaMigration,d as userPasswordEnvName,f as verifyExpectedSchemaVersion};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "9.0.0",
+  "version": "10.1.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -55,6 +55,10 @@
       "types": "./dist/fsHelpers.d.ts",
       "default": "./dist/fsHelpers.js"
     },
+    "./httpKeepAlive": {
+      "types": "./dist/httpKeepAlive.d.ts",
+      "default": "./dist/httpKeepAlive.js"
+    },
     "./cdkTmpdirCleanup": {
       "types": "./dist/cdkTmpdirCleanup.d.ts",
       "default": "./dist/cdkTmpdirCleanup.js"