fjall 0.95.0 → 0.99.1

package/bin/assets/src/util/nonInteractive/nonInteractiveOutput.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Non-interactive output for CI/CD and piped environments.
+ *
+ * Rendering implementations split across:
+ * - ./nonInteractiveCascadeOutput.ts (cascade, parallel, deployment progress)
+ * - ./nonInteractiveSummaryOutput.ts (summary, error detail, secrets)
+ */
+import type { FailureAnalysis } from "@fjall/util/aws";
+import type { OrgSetupEventType, PreDeploymentEventType } from "../../types/callbacks.js";
+import type { CascadeDeploymentResult } from "../../services/deployment/CascadeUtils.js";
+import { type SummaryOptions } from "./nonInteractiveLabels.js";
+export { ORG_SETUP_LABELS, PREPARE_LABELS, PRE_DEPLOY_LABELS, type SummaryOptions } from "./nonInteractiveLabels.js";
+export declare const STEP_STATUS: {
+    readonly COMPLETED: "completed";
+    readonly ERROR: "error";
+    readonly SKIPPED: "skipped";
+};
+export declare class OutputWriter {
+    private stepTimers;
+    private cascadeTimers;
+    private parallelStackTimers;
+    private eventHistory;
+    private lastEcsMessage;
+    private lastDockerMessage;
+    private verbose;
+    private silent;
+    private cascadeResult;
+    private versionUpdate;
+    constructor(options?: {
+        verbose?: boolean;
+        versionUpdate?: {
+            current: string;
+            latest: string;
+            installSource?: "npm" | "homebrew";
+        } | null;
+        /**
+         * When true, suppress stdout writes from `line()` and `indent()`. Used
+         * by agent-mode callers that share an OutputWriter with code paths
+         * which would otherwise interleave human cascade output with the
+         * structured TOON wire format.
+         */
+        silent?: boolean;
+    });
+    line(text: string): void;
+    indent(text: string, level?: number): void;
+    log(message: string, level?: "info" | "debug" | "warn"): void;
+    formatDuration(ms: number): string;
+    private formatCounter;
+    stepStart(stepId: string, stepName: string, stepIndex?: number, stepTotal?: number): void;
+    stepComplete(stepId: string, stepName: string, status: "completed" | "skipped" | "error", stepIndex?: number, stepTotal?: number): void;
+    ssoUrl(url: string | null): void;
+    authComplete(): void;
+    accountDetected(isManagedAccount: boolean): void;
+    configurationDetected(config: {
+        pattern?: string | null;
+        hasDockerfile?: boolean;
+        hasDifferences?: boolean;
+    }): void;
+    orgSetupProgress(event: {
+        type: OrgSetupEventType;
+        phase: string;
+        message?: string;
+        detail?: string;
+    }): void;
+    changeDetectionComplete(changes: {
+        hasOrgChanges: boolean;
+        hasPlatformChanges: boolean;
+        hasAccountChanges: boolean;
+        hasMemberAccounts: boolean;
+        hasPlatformAccount: boolean;
+        hasDomainChanges: boolean;
+        hasDomainConfiguration: boolean;
+    }): void;
+    preDeploymentProgress(event: {
+        type: PreDeploymentEventType;
+        phase: string;
+        message?: string;
+    }): void;
+    dockerProgress(message: string, percentage?: number): void;
+    ecsUpdate(status: string): void;
+    ecsProgress(message: string, percentage?: number): void;
+    openNextProgress(message: string, type: string, status: string): void;
+    resourceProgress(event: {
+        logicalId?: string;
+        resourceType?: string;
+        status?: string;
+        statusReason?: string;
+        timestamp?: Date;
+    }): void;
+    parallelDeployStart(stacks: readonly string[]): void;
+    parallelStackStart(stack: string): void;
+    parallelStackComplete(stack: string, status: string, error?: string): void;
+    parallelDeployComplete(allSuccessful: boolean): void;
+    cascadePhaseStart(_phase: "platform" | "domains" | "accounts"): void;
+    cascadeAccountStart(operationKey: string, _accountId: string, _region: string): void;
+    cascadeAccountPhaseChange(operationKey: string, phase: "bootstrap" | "synth" | "deploy" | "destroy", _region?: string): void;
+    cascadeAccountResourceProgress(operationKey: string, event: {
+        logicalId?: string;
+        resourceType?: string;
+        status?: string;
+        statusReason?: string;
+    }, _region?: string): void;
+    cascadeAccountComplete(operationKey: string, success: boolean, error?: string): void;
+    cascadeComplete(result: CascadeDeploymentResult): void;
+    getCascadeResult(): CascadeDeploymentResult | null;
+    getFailureAnalysis(): FailureAnalysis | null;
+    errorDetail(analysis: FailureAnalysis): void;
+    summary(options: SummaryOptions): void;
+    cdkOutput(_chunk: string): void;
+    secretsWarning(validationResult: {
+        missing: Array<{
+            name: string;
+            expectedPath: string;
+            namespace: {
+                app: string;
+                cluster?: string;
+                service?: string;
+            };
+        }>;
+        totalRequired: number;
+    }): void;
+}
+export declare class NoopOutputWriter extends OutputWriter {
+    stepStart(): void;
+    stepComplete(): void;
+    log(): void;
+    indent(): void;
+}

package/bin/assets/src/util/nonInteractive/nonInteractiveOutput.js

@@ -0,0 +1,4 @@
+import i from"chalk";import{theme as p}from"../theme.js";import{logger as u}from"../logger/index.js";import{formatDuration as m}from"../formatDuration.js";import{renderParallelDeployStart as g,renderParallelStackStart as f,renderParallelStackComplete as $,renderParallelDeployComplete as P,renderCascadeAccountStart as S,renderCascadeAccountPhaseChange as C,renderCascadeAccountResourceProgress as D,renderCascadeAccountComplete as b,renderOrgSetupProgress as x,renderChangeDetectionComplete as y,renderPreDeploymentProgress as k,renderResourceProgress as R}from"./nonInteractiveCascadeOutput.js";import{computeFailureAnalysis as A,renderErrorDetail as E,renderSummary as T,renderSecretsWarning as v}from"./nonInteractiveSummaryOutput.js";import{ORG_SETUP_LABELS as V,PREPARE_LABELS as j,PRE_DEPLOY_LABELS as q}from"./nonInteractiveLabels.js";const W={COMPLETED:"completed",ERROR:"error",SKIPPED:"skipped"},o=p.colours;class w{stepTimers=new Map;cascadeTimers=new Map;parallelStackTimers=new Map;eventHistory=new Map;lastEcsMessage="";lastDockerMessage="";verbose;silent;cascadeResult=null;versionUpdate;constructor(e={}){this.verbose=e.verbose??!1,this.silent=e.silent??!1,this.versionUpdate=e.versionUpdate??null,u.debug("OutputWriter","Constructor",{inputVerbose:e.verbose,resolvedVerbose:this.verbose,silent:this.silent})}line(e){this.silent||process.stdout.write(`${e}
+`)}indent(e,t=1){this.silent||process.stdout.write(`${"  ".repeat(t)}${e}
+`)}log(e,t="info"){const s=t==="warn"?i.hex(o.warning)("[warn]"):i.hex(o.dim)("[log]");this.indent(`${s} ${e}`)}formatDuration(e){return m(e)}formatCounter(e,t){return e!==void 0&&t!==void 0?`[${e}/${t}] `:""}stepStart(e,t,s,r){this.stepTimers.set(e,Date.now());const a=this.formatCounter(s,r);this.line(""),this.line(i.hex(o.summitBlush).bold(`==> ${a}${t}`))}stepComplete(e,t,s,r,a){const l=this.stepTimers.get(e),h=l?this.formatDuration(Date.now()-l):"",n=h?` ${i.hex(o.dim)(`(${h})`)}`:"",c=this.formatCounter(r,a);s==="completed"?this.line(i.hex(o.completed)(`<== ${c}${t}`)+n):s==="error"?this.line(i.hex(o.error)(`x=> ${c}${t}`)+n):this.line(i.hex(o.dim)(`-=> ${c}${t} skipped`)+n)}ssoUrl(e){e&&(this.line(`
+SSO authentication required. Open this URL in your browser:`),this.indent(i.hex(o.primary)(e)),this.line(""))}authComplete(){this.indent(i.hex(o.completed)("\u2713")+" Authentication successful")}accountDetected(e){this.verbose&&this.indent(`Account type: ${e?"managed":"external"}`)}configurationDetected(e){this.verbose&&(this.indent(`Pattern: ${e.pattern??"standard"}`),this.indent(`Docker: ${e.hasDockerfile?"yes":"no"}`),this.indent(`Infrastructure changes: ${e.hasDifferences?"yes":"no"}`))}orgSetupProgress(e){x(this,e,this.verbose)}changeDetectionComplete(e){y(this,e)}preDeploymentProgress(e){k(this,e,this.verbose)}dockerProgress(e,t){if(!e)return;const s=t!==void 0?` (${t}%)`:"",r=`${e}${s}`;r!==this.lastDockerMessage&&(this.lastDockerMessage=r,this.indent(`[docker] ${r}`))}ecsUpdate(e){this.indent(`[ecs] ${e}`)}ecsProgress(e,t){const s=t!==void 0?` (${t}%)`:"",r=`${e}${s}`;r!==this.lastEcsMessage&&(this.lastEcsMessage=r,this.indent(`[ecs] ${r}`))}openNextProgress(e,t,s){const r=s==="complete"?i.hex(o.completed)("\u2713"):s==="error"?i.hex(o.error)("\u2717"):i.hex(o.fjallPink)("\u2026");this.indent(`[opennext:${t}] ${r} ${e}`)}resourceProgress(e){if(e.logicalId&&e.status&&e.resourceType){const t=this.eventHistory.get(e.logicalId)??[];t.push({logicalId:e.logicalId,resourceType:e.resourceType,status:e.status,statusReason:e.statusReason,timestamp:e.timestamp??new Date}),this.eventHistory.set(e.logicalId,t)}R(this,e,this.verbose)}parallelDeployStart(e){g(this,e)}parallelStackStart(e){f(this,this.parallelStackTimers,e)}parallelStackComplete(e,t,s){$(this,this.parallelStackTimers,e,t,s)}parallelDeployComplete(e){P(this,e)}cascadePhaseStart(e){}cascadeAccountStart(e,t,s){S(this,this.cascadeTimers,e,this.verbose)}cascadeAccountPhaseChange(e,t,s){C(this,e,t,this.verbose)}cascadeAccountResourceProgress(e,t,s){D(this,e,t,this.verbose)}cascadeAccountComplete(e,t,s){b(this,this.cascadeTimers,e,t,this.verbose,s)}cascadeComplete(e){u.debug("OutputWriter","cascadeComplete called",{accountCount:e.accountResults.length,hasPlatformResult:!!e.platformResult,verbose:this.verbose}),this.cascadeResult=e}getCascadeResult(){return this.cascadeResult}getFailureAnalysis(){return A(this.eventHistory)}errorDetail(e){E(this,e)}summary(e){T(this,e,this.versionUpdate)}cdkOutput(e){}secretsWarning(e){v(this,e)}}class B extends w{stepStart(){}stepComplete(){}log(){}indent(){}}export{B as NoopOutputWriter,V as ORG_SETUP_LABELS,w as OutputWriter,j as PREPARE_LABELS,q as PRE_DEPLOY_LABELS,W as STEP_STATUS};

package/bin/assets/src/util/nonInteractive/nonInteractiveSummaryOutput.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Summary, error detail, failure analysis, and secrets rendering
+ * for non-interactive output.
+ *
+ * Extracted from nonInteractiveOutput.ts for file-size compliance.
+ */
+import { type FailureAnalysis } from "@fjall/util/aws";
+import type { ResourceEvent } from "../../aws/utils/cloudformationEvents.js";
+import type { SummaryOptions } from "./nonInteractiveLabels.js";
+import type { OutputPrimitives } from "./nonInteractiveCascadeOutput.js";
+export declare function computeFailureAnalysis(eventHistory: Map<string, ResourceEvent[]>): FailureAnalysis | null;
+export declare function renderErrorDetail(out: OutputPrimitives, analysis: FailureAnalysis): void;
+export declare function renderSummary(out: OutputPrimitives, options: SummaryOptions, versionUpdate: {
+    current: string;
+    latest: string;
+    installSource?: "npm" | "homebrew";
+} | null): void;
+export declare function renderSecretsWarning(out: OutputPrimitives, validationResult: {
+    missing: Array<{
+        name: string;
+        expectedPath: string;
+        namespace: {
+            app: string;
+            cluster?: string;
+            service?: string;
+        };
+    }>;
+    totalRequired: number;
+}): void;

package/bin/assets/src/util/nonInteractive/nonInteractiveSummaryOutput.js

@@ -0,0 +1,3 @@
+import r from"chalk";import{theme as v}from"../theme.js";import{CloudFormationFailureAnalyser as b}from"@fjall/util/aws";import{upgradeHint as S}from"../versionDisplay.js";const i=v.colours,u=50;function $(e){const n=`\u2500\u2500 ${e} `;return r.hex(i.dim)(n+"\u2500".repeat(Math.max(0,u-n.length)))}function E(e){return e.size===0?null:new b().analyseFailure(e)}function F(e,n){const c=$("Error Detail"),l=r.hex(i.dim)("\u2500".repeat(u));if(e.line(""),e.line(c),e.line(`  ${r.hex(i.error)(n.summary)}`),e.line(`  Category:   ${n.rootCause.category}`),n.dependencyChain.length>1){e.line(""),e.line("  Dependency chain:");for(const t of n.dependencyChain)e.line(`    ${t}`)}if(n.remediation.length>0){e.line(""),e.line("  Remediation:");for(const t of n.remediation)e.line(`    ${r.hex(i.dim)("\u2022")} ${t}`)}e.line(l)}function I(e,n,c){const{operation:l,target:t,success:s,duration:h}=n,g=e.formatDuration(h),x={deploy:"deployed",destroy:"destroyed",build:"built",create:"created"},d=n.verb??x[l]??`${l} completed`,y=$("Summary"),D=r.hex(i.dim)("\u2500".repeat(u));if(e.line(""),e.line(y),s?e.line(`  Result:   ${r.hex(i.completed)("\u2713")} ${t} ${d} successfully`):e.line(`  Result:   ${r.hex(i.error)("\u2717")} ${t} ${l} failed`),e.line(`  Duration: ${g}`),n.url&&e.line(`  URL:      ${r.hex(i.primary)(n.url)}`),n.details)for(const[m,f]of Object.entries(n.details))e.line(`  ${m.padEnd(9)} ${f}`);const a=n.cascadeResult;if(a){const m=a.accountResults.length,f=a.accountResults.filter(o=>o.success&&!o.skipped).length,R=a.accountResults.filter(o=>o.skipped).length,p=m-R;if(p>0&&e.line(`  Accounts: ${f}/${p} ${d}`),a.platformResult){const o=a.platformResult.success?`1/1 ${d}`:"0/1 failed";e.line(`  Platform: ${o}`)}}e.line(D),c&&(e.line(r.hex(i.deployYellow)(`  Update available: ${c.current} \u2192 ${c.latest}`)),e.line(r.dim(`  ${S(c.installSource)}`)))}function M(e,n){const{missing:c,totalRequired:l}=n;e.line(""),e.line(r.hex(i.warning)(`  Warning: ${c.length} of ${l} required SSM secret(s) are missing:`));for(const t of c)e.indent(`- ${t.name} (expected at ${t.expectedPath})`,2);e.line(""),e.indent("To create missing secrets, run:");for(const t of c){const s=t.namespace;e.indent(r.hex(i.warning)(`fjall secret set ${t.name}=<value> --app ${s.app}${s.cluster?` --cluster ${s.cluster}`:""}${s.service?` --service ${s.service}`:""}`),2)}e.line(r.hex(i.warning)(`
+  Deployment will continue, but ECS tasks may fail to start without these secrets.
+`))}export{E as computeFailureAnalysis,F as renderErrorDetail,M as renderSecretsWarning,I as renderSummary};

package/bin/assets/src/util/organisationStructure.d.ts

@@ -0,0 +1,9 @@
+export type OrganisationDir = {
+    path: string;
+    name: string;
+};
+export declare const ORGANISATION_DIRS: OrganisationDir[];
+declare const ORGANISATION_TARGET_VALUES: readonly ["organisation", "platform", "account"];
+export type OrganisationTarget = (typeof ORGANISATION_TARGET_VALUES)[number];
+export declare const ORGANISATION_TARGETS: ReadonlySet<string>;
+export {};

package/bin/assets/src/util/organisationStructure.js

@@ -0,0 +1 @@
+const a=[{path:"organisation",name:"Organisation"},{path:"platform",name:"Platform"},{path:"account",name:"Account"}],t=["organisation","platform","account"],n=new Set(t);export{a as ORGANISATION_DIRS,n as ORGANISATION_TARGETS};

package/bin/assets/src/util/parseTakeOption.d.ts

@@ -0,0 +1 @@
+export declare function parseTakeOption(raw?: string): number | undefined;

package/bin/assets/src/util/parseTakeOption.js

@@ -0,0 +1 @@
+function i(e){if(e===void 0||e==="")return;const n=parseInt(e,10);if(!Number.isFinite(n)||n<=0)throw new Error(`Invalid --take value: "${e}" (expected a positive integer)`);return n}export{i as parseTakeOption};

package/bin/assets/src/util/passwordValidation.d.ts

@@ -0,0 +1,22 @@
+/**
+ * TODO: Remove this file when import functionality is refactored.
+ * See SecretManagerService.ts TODO for details.
+ */
+import type { ValidationResult } from "../types/validation.js";
+export type { ValidationResult } from "../types/validation.js";
+/**
+ * Validate RDS password requirements (8-128 chars, uppercase, lowercase, number, no /@" or spaces)
+ */
+export declare function validateRdsPassword(password: string): ValidationResult;
+/**
+ * Validate that password and confirmation match
+ */
+export declare function validatePasswordConfirmation(password: string, confirmation: string): ValidationResult;
+/**
+ * Validate all passwords for a set of databases
+ */
+export declare function validateAllPasswords(passwords: Map<string, string>, confirmations: Map<string, string>, resourceNames: string[]): Map<string, ValidationResult>;
+/**
+ * Check if all password validations passed
+ */
+export declare function allPasswordsValid(validations: Map<string, ValidationResult>): boolean;

package/bin/assets/src/util/passwordValidation.js

@@ -0,0 +1 @@
+function u(s){const t=[];return s.length<8&&t.push("Password must be at least 8 characters"),s.length>128&&t.push("Password must be less than 128 characters"),/[a-z]/.test(s)||t.push("Password must contain at least one lowercase letter"),/[A-Z]/.test(s)||t.push("Password must contain at least one uppercase letter"),/[0-9]/.test(s)||t.push("Password must contain at least one number"),/[/@" ]/.test(s)&&t.push('Password cannot contain /, @, ", or spaces'),{valid:t.length===0,errors:t}}function c(s,t){return s!==t?{valid:!1,errors:["Passwords do not match"]}:{valid:!0,errors:[]}}function d(s,t,a){const r=new Map;for(const e of a){const n=s.get(e)||"",l=t.get(e)||"";if(!n){r.set(e,{valid:!1,errors:["Password is required"]});continue}const o=u(n);if(!o.valid){r.set(e,o);continue}const i=c(n,l);if(!i.valid){r.set(e,i);continue}r.set(e,{valid:!0,errors:[]})}return r}function f(s){for(const[t,a]of s)if(!a.valid)return!1;return!0}export{f as allPasswordsValid,d as validateAllPasswords,c as validatePasswordConfirmation,u as validateRdsPassword};

package/bin/assets/src/util/pathHelpers.d.ts

@@ -0,0 +1,19 @@
+export declare function getFjallPath(): string;
+export declare function getProjectRoot(appPath: string): string;
+export declare function getAppNameFromInfrastructure(infrastructurePath: string): string;
+export declare function getAppName(appFolderPath: string): string;
+export declare function getInfrastructurePath(appName: string): string;
+export declare function getAppPath(appName: string): string;
+export declare function getOrganisationComponentPath(componentName: string): string;
+export declare function getDeploymentLogsPath(deploymentType: string): string;
+export declare function getCloudFormationLogsPath(deploymentType: string): string;
+export declare function getDomainsDir(): string;
+export declare function getDomainComponentPath(domainName: string): string;
+export declare function getDomainInfrastructurePath(domainName: string): string;
+export declare function getDomainZoneFilePath(domainName: string): string;
+export declare function getDomainDeployStatePath(domainName: string): string;
+export declare const INFRASTRUCTURE_FILENAME = "infrastructure.ts";
+export declare const ZONE_BIND_FILENAME = "zone.bind";
+export declare const DEPLOY_STATE_FILENAME = ".deploy-state.json";
+export declare const CDK_OUT_DIR = "cdk.out";
+export declare function getCdkOutPath(appPath: string): string;

package/bin/assets/src/util/pathHelpers.js

@@ -0,0 +1 @@
+import{join as o,dirname as c,normalize as p}from"node:path";import{readFileSync as s,existsSync as f}from"node:fs";const r="fjall";function a(t,e){const n=p(t);if(n.includes("..")||n.startsWith("/"))throw new Error(`Invalid ${e}: path traversal is not allowed`)}function E(){return r}function I(t){const e=c(t);return c(e)||"."}function m(t){if(!f(t))throw new Error(`Infrastructure file not found: ${t}`);const n=s(t,"utf-8").match(/const\s+appName\s*=\s*["']([^"']+)["']/);if(!n||!n[1])throw new Error(`Could not find appName in infrastructure file: ${t}. Expected format: const appName = "yourAppName";`);return n[1]}function P(t){const e=o(t,u);return m(e)}function A(t){return a(t,"app name"),o(r,t,u)}function F(t){return a(t,"app name"),o(r,t)}function N(t){return a(t,"component name"),o(r,t)}function j(t){return a(t,"deployment type"),o(r,t,"logs")}function L(t){return a(t,"deployment type"),o(r,t,"logs","cloudformation")}function l(){return o(r,"domains")}function i(t){return a(t,"domain name"),o(l(),t)}function R(t){return o(i(t),u)}function _(t){return o(i(t),x)}function w(t){return o(i(t),g)}const u="infrastructure.ts",x="zone.bind",g=".deploy-state.json",d="cdk.out";function C(t){return o(t,d)}export{d as CDK_OUT_DIR,g as DEPLOY_STATE_FILENAME,u as INFRASTRUCTURE_FILENAME,x as ZONE_BIND_FILENAME,P as getAppName,m as getAppNameFromInfrastructure,F as getAppPath,C as getCdkOutPath,L as getCloudFormationLogsPath,j as getDeploymentLogsPath,i as getDomainComponentPath,w as getDomainDeployStatePath,R as getDomainInfrastructurePath,_ as getDomainZoneFilePath,l as getDomainsDir,E as getFjallPath,A as getInfrastructurePath,N as getOrganisationComponentPath,I as getProjectRoot};

package/bin/assets/src/util/patternDetection.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Re-exports pattern detection from @fjall/deploy-core.
+ *
+ * The authoritative implementation lives in deploy-core. CLI consumers
+ * import from this module so their import paths stay unchanged.
+ */
+export { type OpenNextPattern, OPENNEXT_PATTERNS, isOpenNextPattern, type AppResourceFlags, deriveResourcesFromManifestStacks, detectPattern, detectPayloadPattern as detectPayload, detectDatabase } from "@fjall/deploy-core";

package/bin/assets/src/util/patternDetection.js

@@ -0,0 +1 @@
+import{OPENNEXT_PATTERNS as a,isOpenNextPattern as r,deriveResourcesFromManifestStacks as d,detectPattern as s,detectPayloadPattern as P,detectDatabase as c}from"@fjall/deploy-core";export{a as OPENNEXT_PATTERNS,d as deriveResourcesFromManifestStacks,c as detectDatabase,s as detectPattern,P as detectPayload,r as isOpenNextPattern};

package/bin/assets/src/util/promptYesNo.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Prompt the user via readline for a yes/no answer.
+ * Returns false if stdin is not a TTY (CI/CD).
+ */
+export declare function promptYesNo(question: string): Promise<boolean>;

package/bin/assets/src/util/promptYesNo.js

@@ -0,0 +1 @@
+import*as t from"readline";function i(o){if(!process.stdin.isTTY)return Promise.resolve(!1);const e=t.createInterface({input:process.stdin,output:process.stderr});return new Promise(r=>{e.once("close",()=>r(!1)),e.question(`${o} (y/N): `,s=>{e.close(),r(s.trim().toLowerCase()==="y"||s.trim().toLowerCase()==="yes")})})}export{i as promptYesNo};

package/bin/assets/src/util/readStdin.d.ts

@@ -0,0 +1,9 @@
+import { type Result } from "../types/Result.js";
+/**
+ * Read all of stdin into a UTF-8 string, enforcing a timeout. Strips a single
+ * trailing newline so piped values (`echo foo | ...`) match user intent.
+ *
+ * Returns a `Result` rather than throwing — callers at the command boundary
+ * can surface errors via their OutputWriter without a try/catch.
+ */
+export declare function readStdinWithTimeout(timeoutMs: number): Promise<Result<string, Error>>;

package/bin/assets/src/util/readStdin.js

@@ -0,0 +1 @@
+import{failure as a,success as u}from"../types/Result.js";async function d(e){const n=[],o=(async()=>{for await(const r of process.stdin)n.push(Buffer.from(r))})();o.catch(()=>{});let t;const s=new Promise((r,c)=>{t=setTimeout(()=>c(new Error(`stdin read timed out after ${e/1e3}s`)),e)});try{await Promise.race([o,s])}catch(r){return process.stdin.destroy(),a(r instanceof Error?r:new Error(String(r)))}finally{t!==void 0&&clearTimeout(t)}const i=Buffer.concat(n).toString("utf-8").replace(/\n$/,"");return u(i)}export{d as readStdinWithTimeout};

package/bin/assets/src/util/secretsUtils.d.ts

@@ -0,0 +1,155 @@
+/**
+ * Shared utilities for Fjall Secrets Management
+ *
+ * Provides common functions for formatting, validation, and error handling
+ * across the secrets implementation (commands, services, and UI screens).
+ */
+import type { SecretNamespace, SecretEntry } from "../types/secrets.js";
+import { type Result } from "../types/Result.js";
+export declare const APP_NAME_PATTERN: RegExp;
+export declare const SECRET_NAME_PATTERN: RegExp;
+export declare const APP_NAME_ERROR: "Must start with a letter, contain only letters, numbers, and hyphens";
+export declare const SECRET_NAME_ERROR: "Secret name must start with a letter or underscore and contain only letters, numbers, underscores, hyphens, or periods";
+/**
+ * Format a namespace for display.
+ *
+ * Builds a hierarchical path string from the namespace components.
+ * If the namespace is undefined, returns "(not set)".
+ *
+ * @param ns - The secret namespace to format, or undefined
+ * @returns A formatted path string (e.g., "/myapp/prod/api") or "(not set)"
+ *
+ * @example
+ * formatNamespace({ app: "myapp" }) // returns "/myapp"
+ * formatNamespace({ app: "myapp", cluster: "prod" }) // returns "/myapp/prod"
+ * formatNamespace({ app: "myapp", cluster: "prod", service: "api" }) // returns "/myapp/prod/api"
+ * formatNamespace(undefined) // returns "(not set)"
+ */
+export declare function formatNamespace(ns: SecretNamespace | undefined): string;
+/**
+ * Build the SSM parameter path from a namespace and optional secret name.
+ *
+ * Constructs the full path used in AWS SSM Parameter Store following
+ * the Fjall hierarchy:
+ * - ECS: /<app>/<cluster>/<service>/<name>
+ * - Lambda: /<app>/lambda/<functionName>/<name>
+ *
+ * @param namespace - The secret namespace containing app, cluster, service, or lambda
+ * @param name - Optional secret name to append to the path
+ * @returns The full SSM parameter path
+ *
+ * @example
+ * buildParameterPath({ app: "myapp" }) // returns "/myapp"
+ * buildParameterPath({ app: "myapp", cluster: "prod" }, "API_KEY") // returns "/myapp/prod/API_KEY"
+ * buildParameterPath({ app: "myapp", cluster: "prod", service: "api" }, "DB_URL") // returns "/myapp/prod/api/DB_URL"
+ * buildParameterPath({ app: "myapp", lambda: "handler" }, "API_KEY") // returns "/myapp/lambda/handler/API_KEY"
+ */
+export declare function buildParameterPath(namespace: SecretNamespace, name?: string): string;
+/**
+ * Parse an SSM secrets path into a SecretNamespace.
+ *
+ * This is the inverse of buildParameterPath. It extracts the namespace
+ * components from an SSM path string.
+ *
+ * @param ssmSecretsPath - The SSM path (e.g., "/myapp/cluster/service")
+ * @param fallbackApp - Fallback app name if path is malformed
+ * @param lambdaName - If provided, creates a Lambda namespace instead of ECS
+ * @returns The parsed SecretNamespace
+ *
+ * @example
+ * parseNamespaceFromPath("/myapp/cluster/service", "default")
+ * // returns { app: "myapp", cluster: "cluster", service: "service" }
+ *
+ * parseNamespaceFromPath("/myapp/lambda/handler", "default", "handler")
+ * // returns { app: "myapp", lambda: "handler" }
+ */
+export declare function parseNamespaceFromPath(ssmSecretsPath: string, fallbackApp: string, lambdaName?: string): SecretNamespace;
+/**
+ * Validate an application name.
+ *
+ * Application names must start with a letter and contain only
+ * letters, numbers, and hyphens.
+ *
+ * @param name - The application name to validate
+ * @returns true if the name is valid, false otherwise
+ *
+ * @example
+ * isValidAppName("myapp") // returns true
+ * isValidAppName("my-app-123") // returns true
+ * isValidAppName("MyApp") // returns true
+ * isValidAppName("123app") // returns false (starts with number)
+ */
+export declare function isValidAppName(name: string): boolean;
+/**
+ * Validate a secret namespace.
+ *
+ * A namespace must have a non-empty app name, and if a service is specified,
+ * a cluster must also be specified.
+ *
+ * @param namespace - The namespace to validate
+ * @returns true if the namespace is valid, false otherwise
+ *
+ * @example
+ * isValidNamespace({ app: "myapp" }) // returns true
+ * isValidNamespace({ app: "myapp", cluster: "prod" }) // returns true
+ * isValidNamespace({ app: "myapp", cluster: "prod", service: "api" }) // returns true
+ * isValidNamespace({ app: "myapp", service: "api" }) // returns false (service without cluster)
+ * isValidNamespace({ app: "" }) // returns false (empty app)
+ */
+export declare function isValidNamespace(namespace: SecretNamespace): boolean;
+/**
+ * Validate a secret name.
+ *
+ * Secret names must start with a letter or underscore and contain only
+ * letters, numbers, underscores, hyphens, or periods. This matches
+ * the characters allowed by AWS SSM Parameter Store.
+ *
+ * @param name - The secret name to validate
+ * @returns true if the name is valid, false otherwise
+ *
+ * @example
+ * isValidSecretName("API_KEY") // returns true
+ * isValidSecretName("db.password") // returns true
+ * isValidSecretName("my-secret") // returns true
+ * isValidSecretName("123_KEY") // returns false (starts with number)
+ */
+export declare function isValidSecretName(name: string): boolean;
+/**
+ * Parse .env file contents into key-value pairs.
+ *
+ * Parses a dotenv-formatted string, extracting valid secret names and values.
+ * Handles both single and double-quoted values, comments, and empty lines.
+ *
+ * **Limitation**: Multiline values are not supported. Values containing literal
+ * newlines (e.g., private keys, certificates) will be truncated at the first
+ * newline. For such values, use base64 encoding or store them in AWS Secrets
+ * Manager instead of SSM Parameter Store.
+ *
+ * @param content - The raw .env file content
+ * @returns A record of secret names to values
+ *
+ * @example
+ * parseDotEnv('API_KEY="abc123"\nDB_URL=postgres://...')
+ * // returns { API_KEY: "abc123", DB_URL: "postgres://..." }
+ */
+export declare function parseDotEnv(content: string): Record<string, string>;
+/**
+ * Parse a key=value pair, validating the key is a valid secret name.
+ */
+export declare function parseKeyValue(input: string): {
+    key: string;
+    value: string;
+} | null;
+/**
+ * Read a secret value from a file, trimming the trailing newline.
+ */
+export declare function readSecretValueFromFile(filePath: string): Result<string, Error>;
+/**
+ * Read and parse a .env file into key-value pairs.
+ * Returns failure if the file doesn't exist, can't be read, or contains no valid secrets.
+ */
+export declare function readDotEnvFile(filePath: string): Result<Record<string, string>, Error>;
+/**
+ * Format a list of secrets as an aligned table string.
+ */
+export declare function formatSecretsTable(secrets: readonly SecretEntry[]): string;

package/bin/assets/src/util/secretsUtils.js

@@ -0,0 +1,3 @@
+import{existsSync as u,readFileSync as c}from"node:fs";import{success as l,failure as a}from"../types/Result.js";import{VALIDATION_PATTERNS as f,VALIDATION_MESSAGES as p}from"../validation/patterns.js";import{getErrorMessage as d}from"./errorUtils.js";const h=f.IDENTIFIER,E=f.SECRET_NAME,M=p.IDENTIFIER,P=p.SECRET_NAME;function m(e){const t=[e.app];return e.lambda?t.push("lambda",e.lambda):(e.cluster&&t.push(e.cluster),e.service&&e.cluster&&t.push(e.service)),t}function _(e){return e?"/"+m(e).join("/"):"(not set)"}function $(e,t){const n=m(e);return t&&n.push(t),"/"+n.join("/")}function g(e,t,n){const r=e.split("/").filter(Boolean);return n?{app:r[0]??t,lambda:n}:{app:r[0]??t,cluster:r.length>1?r[1]:void 0,service:r.length>2?r[2]:void 0}}function v(e){return h.test(e)}function F(e){return!(!e.app||e.service&&!e.cluster)}function N(e){return E.test(e)}function A(e){const t={};for(const n of e.split(`
+`)){const r=n.trim();if(!r||r.startsWith("#"))continue;const o=r.indexOf("=");if(o===-1)continue;const i=r.slice(0,o).trim();if(!E.test(i))continue;const s=r.slice(o+1),x=s.length>=2&&(s.startsWith('"')&&s.endsWith('"')||s.startsWith("'")&&s.endsWith("'"))?s.slice(1,-1):s;t[i]=x}return t}function b(e){const t=e.indexOf("=");if(t===-1)return null;const n=e.substring(0,t),r=e.substring(t+1);return N(n)?{key:n,value:r}:null}function y(e){if(!u(e))return a(new Error(`File not found: ${e}`));try{return l(c(e,"utf-8").replace(/\n$/,""))}catch(t){return a(new Error(d(t)))}}function O(e){if(!u(e))return a(new Error(`File not found: ${e}`));let t;try{t=c(e,"utf-8")}catch(r){return a(new Error(`Could not read file: ${d(r)}`))}const n=A(t);return Object.keys(n).length===0?a(new Error("No valid secrets found in file")):l(n)}function V(e){const t=e.reduce((o,i)=>Math.max(o,i.name.length),4),n=e.reduce((o,i)=>Math.max(o,i.fullPath.length),4),r=[`  ${"Name".padEnd(t)}  ${"Path".padEnd(n)}  Last Modified`,`  ${"-".repeat(t)}  ${"-".repeat(n)}  ${"-".repeat(20)}`];for(const o of e){const i=o.lastModified?o.lastModified.toISOString().replace("T"," ").slice(0,19):"N/A";r.push(`  ${o.name.padEnd(t)}  ${o.fullPath.padEnd(n)}  ${i}`)}return r.join(`
+`)}export{M as APP_NAME_ERROR,h as APP_NAME_PATTERN,P as SECRET_NAME_ERROR,E as SECRET_NAME_PATTERN,$ as buildParameterPath,_ as formatNamespace,V as formatSecretsTable,v as isValidAppName,F as isValidNamespace,N as isValidSecretName,A as parseDotEnv,b as parseKeyValue,g as parseNamespaceFromPath,O as readDotEnvFile,y as readSecretValueFromFile};

package/bin/assets/src/util/signalCleanup.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Registers a cleanup function with ProcessManager for graceful cancellation
+ * in CLI commands. The cleanup is automatically deregistered when the wrapped
+ * function completes.
+ *
+ * Always prints the cancellation message on shutdown, even when no cleanup
+ * callback is provided.
+ *
+ * @param message - User-facing cancellation message (e.g. "Deployment cancelled by user")
+ * @param fn - The async operation to wrap
+ * @param cleanup - Optional async cleanup before exit (e.g. AwsContext.destroyInstance)
+ */
+export declare function withSignalCleanup<T>(message: string, fn: () => Promise<T>, cleanup?: () => Promise<void>): Promise<T>;

package/bin/assets/src/util/signalCleanup.js

@@ -0,0 +1,4 @@
+import{processManager as a}from"../ui/utils/ProcessManager.js";async function s(n,t,r){const i=a.registerCleanup(`withSignalCleanup: ${n}`,async()=>{process.stderr.write(`
+
+${n}
+`),r&&await r()});try{return await t()}finally{i()}}export{s as withSignalCleanup};

package/bin/assets/src/util/stripAnsi.d.ts

@@ -0,0 +1,2 @@
+/** Strip ANSI escape codes from a string (SGR, CSI, and OSC sequences) */
+export declare function stripAnsi(str: string): string;

package/bin/assets/src/util/stripAnsi.js

@@ -0,0 +1 @@
+function r(x){return x.replace(/\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07]*\x07|\x1b\(B/g,"")}export{r as stripAnsi};

package/bin/assets/src/util/synchronizedOutput.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Synchronized terminal output using DEC private mode 2026.
+ *
+ * Wraps frame writes in BSU/ESU (Begin/End Synchronized Update) markers
+ * so the terminal renders each frame atomically, preventing flicker during
+ * high-frequency updates (e.g. CloudFormation events, spinner + progress).
+ *
+ * Safe no-op on terminals that don't support it.
+ */
+/** Begin Synchronized Update — tells the terminal to buffer output */
+declare const BSU = "\u001B[?2026h";
+/** End Synchronized Update — tells the terminal to flush the buffer */
+declare const ESU = "\u001B[?2026l";
+/** Whether the current terminal supports synchronized output */
+export declare const SYNC_OUTPUT_SUPPORTED: boolean;
+/**
+ * Wrap a stdout write function so each call is sent as an atomic frame.
+ * On unsupported terminals, returns the original function unchanged.
+ */
+export declare function wrapSynchronizedOutput(write: (data: string) => boolean): (data: string) => boolean;
+/**
+ * Wrap raw data in BSU/ESU markers for synchronized output.
+ * Returns the data unchanged on unsupported terminals.
+ */
+export declare function synchronize(data: string): string;
+export { BSU, ESU };

package/bin/assets/src/util/synchronizedOutput.js

@@ -0,0 +1 @@
+const n="\x1B[?2026h",o="\x1B[?2026l";function c(){if(process.env.TMUX)return!1;const r=process.env.TERM_PROGRAM??"",t=process.env.TERM??"";if(r==="iTerm.app"||r==="ghostty"||r==="WezTerm"||t.includes("kitty")||t==="foot"||t==="foot-extra"||r==="Alacritty"||process.env.WT_SESSION)return!0;const e=process.env.VTE_VERSION;if(e){const s=parseInt(e.slice(0,2),10),i=parseInt(e.slice(2,4),10);if(s>0||i>=68)return!0}return!1}const u=c();function f(r){return u?t=>r(n+t+o):r}function p(r){return u?n+r+o:r}export{n as BSU,o as ESU,u as SYNC_OUTPUT_SUPPORTED,p as synchronize,f as wrapSynchronizedOutput};

package/bin/assets/src/util/targetDetection.d.ts

@@ -0,0 +1,27 @@
+import { type Result } from "../types/Result.js";
+export type TargetType = "organisation" | "application";
+export interface Target {
+    name: string;
+    type: TargetType;
+    path: string;
+    description: string;
+    appName?: string;
+}
+export declare function getAvailableTargets(baseDir?: string): Target[];
+export declare function getOrganisationTargets(baseDir?: string): Target[];
+export declare function getApplicationTargets(baseDir?: string): Target[];
+/** Local app targets intersected with apps registered on the Fjall API for the authenticated org. */
+export declare function getRegisteredApplicationTargets(baseDir?: string): Promise<Result<Target[], Error>>;
+/** Check if a target name is an organisation target */
+export declare function isOrganisationTarget(targetName: string): boolean;
+export interface TargetValidationResult {
+    error?: string;
+    path: string;
+}
+interface TargetValidationMessages {
+    folderNotFound: string;
+    noInfrastructure: string;
+}
+/** Validate that a deploy/destroy target exists and has required files */
+export declare function validateTarget(target: string, messages: TargetValidationMessages): TargetValidationResult;
+export {};

package/bin/assets/src/util/targetDetection.js

@@ -0,0 +1 @@
+import{existsSync as a,readdirSync as y}from"fs";import{join as c}from"path";import{ORGANISATION_DIRS as h,ORGANISATION_TARGETS as C}from"./organisationStructure.js";import{Config as I}from"@fjall/util/config";import{logger as N}from"./logger/index.js";import{getAppNameFromInfrastructure as w,getAppPath as R,getOrganisationComponentPath as S,INFRASTRUCTURE_FILENAME as d}from"./pathHelpers.js";import{FjallApiClient as D}from"./api/FjallApiClient.js";import{success as F,failure as A}from"../types/Result.js";function T(e){const t=[],o=e||(()=>{const r=I.getConfigDirectory();return r&&a(r)?r:process.cwd()})();if(!o||!a(o))return t;const n=o;if(!a(n))return t;const i=y(n,{withFileTypes:!0});for(const r of i){if(!r.isDirectory())continue;const s=c(o,r.name),g=h.find(p=>p.path===r.name);if(g)t.push({name:r.name,type:"organisation",path:s,description:g.name||r.name});else{const p=a(c(s,"cdk.json")),f=c(s,d),l=a(f);if(p||l){let u;if(l)try{u=w(f)}catch(m){N.debug("TargetDetection","Failed to parse infrastructure, falling back to directory name",{path:f,error:m instanceof Error?m.message:String(m)}),u=r.name}t.push({name:r.name,type:"application",path:s,description:"Application",appName:u})}}}return t}function _(e){return T(e).filter(t=>t.type==="organisation")}function O(e){return T(e).filter(t=>t.type==="application")}async function v(e){const t=O(e),o=D.fromCredentials();if(!o)return A(new Error("Not authenticated \u2014 run `fjall login` and try again."));const n=await o.listApps();if(!n.success)return A(new Error(`Could not reach Fjall API: ${n.error.message}`));const i=new Set(n.data.map(r=>r.name.toLowerCase()));return F(t.filter(r=>i.has(r.name.toLowerCase())))}function U(e){return h.some(t=>t.path===e)}function J(e,t){const o=C.has(e.toLowerCase()),n=o?S(e):R(e);if(!a(n))return{error:t.folderNotFound,path:n};if(!o){const i=c(n,d);if(!a(i))return{error:t.noInfrastructure,path:n}}return{path:n}}export{O as getApplicationTargets,T as getAvailableTargets,_ as getOrganisationTargets,v as getRegisteredApplicationTargets,U as isOrganisationTarget,J as validateTarget};

package/bin/assets/src/util/targetHelpers.d.ts

@@ -0,0 +1,20 @@
+import { type ProviderAccount } from "@fjall/util/config";
+export declare const TARGET_MESSAGES: {
+    readonly FETCH_ORG_CONFIG_FAILED: "Failed to fetch organisation config. Are you logged in?";
+    readonly FETCH_ORG_CONFIG_ERROR: "Failed to fetch organisation config";
+    readonly NO_TARGETS_AVAILABLE: "No deployment targets available. Connect an AWS account first.";
+    readonly NO_ACTIVE_TARGET: "No active target set. Use 'fjall target set' to set one.";
+    readonly NO_ACTIVE_TARGET_CLI: "No active target set. Use 'fjall target set <name>' to set one.";
+    readonly TARGET_STALE: "Target no longer exists in organisation config";
+};
+/** Filter out the root management account — used when listing deployable targets. */
+export declare function filterNonRootAccounts(accounts: ProviderAccount[]): ProviderAccount[];
+/**
+ * Filter out every structural environment (root, platform, and any future
+ * additions) — used by `accounts list` and the MCP `plan_app_scaffold`
+ * auto-target resolver. New entries to `STRUCTURAL_ENVIRONMENTS` are
+ * automatically excluded.
+ */
+export declare function filterStructuralAccounts(accounts: ProviderAccount[]): ProviderAccount[];
+export declare function loadActiveTarget(): string | undefined;
+export declare function saveActiveTarget(name: string): void;

package/bin/assets/src/util/targetHelpers.js

@@ -0,0 +1 @@
+import{Config as o}from"@fjall/util/config";import{STRUCTURAL_ENVIRONMENTS as n}from"@fjall/util";const c={FETCH_ORG_CONFIG_FAILED:"Failed to fetch organisation config. Are you logged in?",FETCH_ORG_CONFIG_ERROR:"Failed to fetch organisation config",NO_TARGETS_AVAILABLE:"No deployment targets available. Connect an AWS account first.",NO_ACTIVE_TARGET:"No active target set. Use 'fjall target set' to set one.",NO_ACTIVE_TARGET_CLI:"No active target set. Use 'fjall target set <name>' to set one.",TARGET_STALE:"Target no longer exists in organisation config"},i=new Set(Object.values(n));function g(t){return t.filter(e=>e.environment!==n.ROOT)}function T(t){return t.filter(e=>!i.has(e.environment))}function s(){return o.loadConfig().getActiveTarget()}function f(t){const e=o.loadConfig();e.setActiveTarget(t),e.saveConfig()}export{c as TARGET_MESSAGES,g as filterNonRootAccounts,T as filterStructuralAccounts,s as loadActiveTarget,f as saveActiveTarget};

package/bin/assets/src/util/terminalCapabilities.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Initialise terminal capability detection.
+ * Adjusts chalk colour level based on detected terminal environment.
+ *
+ * Order matters:
+ * 1. Boost xterm.js first (VS Code reports level 2 but supports truecolor)
+ * 2. Clamp for tmux (default tmux config doesn't pass truecolor to outer terminal)
+ */
+export declare function initTerminalCapabilities(): void;
+/** Whether the process is running inside tmux */
+export declare function isTmux(): boolean;
+/** Whether chalk level was clamped for tmux compatibility */
+export declare function isTmuxClamped(): boolean;
+/** Whether chalk level was boosted for VS Code xterm.js */
+export declare function isXtermJsBoosted(): boolean;
+/** Whether the terminal supports truecolor (24-bit RGB) */
+export declare function isFullColor(): boolean;
+/** Whether the terminal supports 256 colours */
+export declare function is256Color(): boolean;
+/** Reset state for test isolation */
+export declare function _resetTerminalCapabilities(): void;

package/bin/assets/src/util/terminalCapabilities.js

@@ -0,0 +1 @@
+import e from"chalk";import{logger as n}from"./logger/index.js";let o=!1,r=!1,t=!1,i=!1,l;function f(){if(o)return;o=!0,l=e.level,r=!!process.env.TMUX,(process.env.TERM_PROGRAM??"")==="vscode"&&e.level===2&&(e.level=3,i=!0,n.debug("Terminal","Boosted chalk level to 3 (truecolor) for VS Code xterm.js")),r&&!process.env.FJALL_TMUX_TRUECOLOR&&e.level>2&&(e.level=2,t=!0,n.debug("Terminal","Clamped chalk level to 2 (256-color) for tmux compatibility",{originalLevel:l}))}function m(){return r}function c(){return t}function p(){return i}function v(){return e.level>=3}function d(){return e.level>=2}function x(){l!==void 0&&(e.level=l),o=!1,r=!1,t=!1,i=!1,l=void 0}export{x as _resetTerminalCapabilities,f as initTerminalCapabilities,d as is256Color,v as isFullColor,m as isTmux,c as isTmuxClamped,p as isXtermJsBoosted};