@cargo-ai/cdk 1.0.11 → 1.0.12

package/build/src/deploy/pull/enumerate.js

@@ -0,0 +1,258 @@
+// Workspace enumeration (the only IO in the pull pipeline besides file writes).
+// Calls the list/all endpoint for each requested kind and returns raw rows for
+// the pure mappers. Kept thin and kind-keyed so mappers stay fixture-testable.
+//
+// Kinds are fetched concurrently, and per-row secondary fetches (workflow
+// releases, file bytes, source archives) fan out per kind — only the output
+// ORDER is fixed, since dedupeSlugs disambiguates colliding slugs in input
+// order and generated file paths depend on it.
+import { isNotFound } from "../readers.live.js";
+import { UNIFY_EXTRACTOR_SLUGS } from "./mappers.js";
+import { untarGz } from "./untar.js";
+// The fixed output order (independent of the requested `kinds` order).
+const ENUMERATION_ORDER = [
+    "folder",
+    "connector",
+    "customIntegration",
+    "model",
+    "relationship",
+    "segment",
+    "tool",
+    "play",
+    "mcpServer",
+    "agent",
+    "capacity",
+    "territory",
+    "file",
+    "worker",
+    "app",
+    "context",
+];
+// Deterministic per-row conditions that skip the row rather than abort the
+// pull: the target is gone, or its content is beyond the API's read limits
+// (readBytes/runtime.read reject >10MiB with a `tooLarge` reason). Anything
+// else — auth, network, server errors — propagates: a blip must not be
+// misread as "nothing there" and silently shrink the pulled workspace.
+function isSkippableRead(error) {
+    if (isNotFound(error))
+        return true;
+    const reason = error.reason;
+    if (typeof reason === "string" && /toolarge/i.test(reason))
+        return true;
+    const message = error instanceof Error ? error.message : String(error);
+    return /too large/i.test(message);
+}
+export async function enumerateWorkspace(api, kinds) {
+    // Shared by the model and relationship collectors — fetched once.
+    const cache = {};
+    function allModels() {
+        if (cache.models === undefined) {
+            cache.models = api.storage.model.all().then(({ models }) => models);
+        }
+        return cache.models;
+    }
+    // A play/tool's body lives in its deployed workflow release. Not-found
+    // (never deployed) → null, so the mapper can decide (skip a tool, or emit a
+    // play without a workflow); any other error propagates — a network blip must
+    // not read as "never deployed" and silently skip the resource.
+    async function deployedWorkflow(workflowUuid) {
+        try {
+            const { release } = await api.orchestration.release.getDeployed({
+                workflowUuid,
+            });
+            return release;
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+    }
+    async function fileBytes(uuid) {
+        try {
+            const blob = await api.content.file.readBytes(uuid);
+            return new Uint8Array(await blob.arrayBuffer());
+        }
+        catch (error) {
+            if (isSkippableRead(error))
+                return undefined;
+            throw error;
+        }
+    }
+    // Download + extract the promoted deployment's source tree (the pre-build
+    // project the user uploaded). Null when never promoted or not exportable.
+    async function deploymentSource(promotedDeployment) {
+        if (promotedDeployment === null || promotedDeployment === undefined) {
+            return null;
+        }
+        const uuid = promotedDeployment["uuid"];
+        if (typeof uuid !== "string")
+            return null;
+        let url;
+        try {
+            ({ url } = await api.hosting.deployment.getSourceArchiveUrl({ uuid }));
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+        const response = await fetch(url);
+        // 403/404: the archive object is gone or not exportable — skip the row
+        // (S3 answers 403 AccessDenied for missing keys). Server errors propagate.
+        if (response.status === 403 || response.status === 404)
+            return null;
+        if (!response.ok) {
+            throw new Error(`failed to download deployment source ${uuid}: HTTP ${String(response.status)}`);
+        }
+        return untarGz(new Uint8Array(await response.arrayBuffer()));
+    }
+    // The workspace's single context repo: its uuid + every markdown file. Null
+    // when the workspace has no repo.
+    async function contextRow() {
+        let repositoryUuid;
+        try {
+            const { repository } = await api.context.repository.get();
+            repositoryUuid = repository["uuid"];
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+        const { entries } = await api.context.runtime.browse({ depth: -1 });
+        const markdown = entries.filter((entry) => entry.kind === "file" && /\.mdx?$/i.test(entry.path));
+        // An unreadable file (gone, oversized) skips that file, not the pull.
+        const contents = await Promise.all(markdown.map(async (entry) => {
+            try {
+                return (await api.context.runtime.read({ path: entry.path })).content;
+            }
+            catch (error) {
+                if (isSkippableRead(error))
+                    return undefined;
+                throw error;
+            }
+        }));
+        const files = {};
+        markdown.forEach((entry, index) => {
+            const content = contents[index];
+            if (content !== undefined)
+                files[entry.path] = content;
+        });
+        return { uuid: repositoryUuid, __files: files };
+    }
+    const rows = (kind, raws) => raws.map((raw) => ({ kind, row: raw }));
+    const collectors = {
+        folder: async () => rows("folder", (await api.workspaceManagement.folder.all()).folders),
+        connector: async () => rows("connector", (await api.connection.connector.list({})).connectors),
+        customIntegration: async () => rows("customIntegration", (await api.connection.customIntegration.list()).customIntegrations),
+        model: async () => rows("model", await allModels()),
+        relationship: async () => {
+            // Relationships touching a unify model are auto-generated alongside it —
+            // flag them here (the mapper is pure and can't see the model rows) so
+            // they are skipped rather than authored.
+            const [{ relationships }, models] = await Promise.all([
+                api.storage.relationship.all(),
+                allModels(),
+            ]);
+            const unifyModelUuids = new Set(models
+                .filter((m) => UNIFY_EXTRACTOR_SLUGS.has(m.extractorSlug))
+                .map((m) => m.uuid));
+            return relationships.map((row) => ({
+                kind: "relationship",
+                row: {
+                    ...row,
+                    __touchesUnifyModel: unifyModelUuids.has(row.fromModelUuid) ||
+                        unifyModelUuids.has(row.toModelUuid),
+                },
+            }));
+        },
+        segment: async () => rows("segment", (await api.segmentation.segment.all()).segments),
+        tool: async () => {
+            const { tools } = await api.orchestration.tool.all();
+            return Promise.all(tools.map(async (row) => ({
+                kind: "tool",
+                row: {
+                    ...row,
+                    __workflow: await deployedWorkflow(row.workflowUuid),
+                },
+            })));
+        },
+        play: async () => {
+            const { plays } = await api.orchestration.play.list({});
+            // A dangling backing segment (deleted out of band) skips those fields,
+            // not the play — the mapper treats a null __segment as "no overrides".
+            const backingSegment = async (uuid) => {
+                try {
+                    const { segment } = await api.segmentation.segment.get(uuid);
+                    return segment;
+                }
+                catch (error) {
+                    if (isNotFound(error))
+                        return null;
+                    throw error;
+                }
+            };
+            return Promise.all(plays.map(async (row) => {
+                // filter/sort/limit/trackingColumnSlugs live on the backing segment.
+                const [workflow, segment] = await Promise.all([
+                    deployedWorkflow(row.workflowUuid),
+                    backingSegment(row.segmentUuid),
+                ]);
+                return {
+                    kind: "play",
+                    row: {
+                        ...row,
+                        __workflow: workflow,
+                        __segment: segment,
+                    },
+                };
+            }));
+        },
+        mcpServer: async () => rows("mcpServer", (await api.ai.mcpServer.all()).mcpServers),
+        agent: async () => rows("agent", (await api.ai.agent.all()).agents),
+        capacity: async () => rows("capacity", (await api.revenueOrganization.capacity.all()).capacities),
+        territory: async () => rows("territory", (await api.revenueOrganization.territory.all()).territories),
+        file: async () => {
+            const { files } = await api.content.file.all();
+            return Promise.all(files.map(async (row) => ({
+                kind: "file",
+                // Unreadable content → __bytes undefined and the mapper skips it.
+                row: { ...row, __bytes: await fileBytes(row.uuid) },
+            })));
+        },
+        worker: async () => {
+            const { workers } = await api.hosting.worker.list();
+            return Promise.all(workers.map(async (row) => ({
+                kind: "worker",
+                row: {
+                    ...row,
+                    __sourceFiles: await deploymentSource(row["promotedDeployment"]),
+                },
+            })));
+        },
+        app: async () => {
+            const { apps } = await api.hosting.app.list();
+            return Promise.all(apps.map(async (row) => ({
+                kind: "app",
+                row: {
+                    ...row,
+                    __sourceFiles: await deploymentSource(row["promotedDeployment"]),
+                },
+            })));
+        },
+        context: async () => {
+            const row = await contextRow();
+            return row === null ? [] : [{ kind: "context", row }];
+        },
+    };
+    // A requested kind missing from `collectors` or ENUMERATION_ORDER would
+    // otherwise be silently never enumerated — the registries must stay in sync.
+    const unenumerable = kinds.filter((kind) => collectors[kind] === undefined || !ENUMERATION_ORDER.includes(kind));
+    if (unenumerable.length > 0) {
+        throw new Error(`cdk pull: no enumerator for kind(s) ${unenumerable.join(", ")} — add them to collectors and ENUMERATION_ORDER.`);
+    }
+    const wanted = ENUMERATION_ORDER.filter((kind) => kinds.includes(kind));
+    const chunks = await Promise.all(wanted.map((kind) => collectors[kind]()));
+    return chunks.flat();
+}

package/build/src/deploy/pull/index.d.ts

@@ -0,0 +1,28 @@
+import type { Api } from "@cargo-ai/api";
+import type { ResourceKind } from "../../core.js";
+import { type IRResource } from "./ir.js";
+import { type GeneratedFile } from "./print.js";
+export { SUPPORTED_KINDS } from "./ir.js";
+export declare const SKIP_REASONS: Partial<Record<ResourceKind, string>>;
+export type PullOptions = {
+    readonly kinds?: readonly ResourceKind[];
+    readonly dryRun?: boolean;
+    readonly noAdopt?: boolean;
+};
+export type PullResult = {
+    readonly files: readonly GeneratedFile[];
+    readonly counts: Readonly<Record<string, number>>;
+    readonly skipped: Readonly<Record<string, number>>;
+    readonly envNames: readonly string[];
+    readonly adopted: number;
+};
+export declare function generateFiles(rows: {
+    kind: ResourceKind;
+    row: Record<string, unknown>;
+}[]): {
+    files: GeneratedFile[];
+    resources: IRResource[];
+    skipped: Record<string, number>;
+};
+export declare function pull(root: string, api: Api, workspaceUuid: string, options?: PullOptions): Promise<PullResult>;
+//# sourceMappingURL=index.d.ts.map

package/build/src/deploy/pull/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/deploy/pull/index.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAIlD,OAAO,EAAE,KAAK,UAAU,EAAmC,MAAM,SAAS,CAAC;AAE3E,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,YAAY,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1C,eAAO,MAAM,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAY9D,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IAExB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAG1B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,CAAC;IAEzC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGlD,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAGnD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AA8DF,wBAAgB,aAAa,CAC3B,IAAI,EAAE;IACJ,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B,EAAE,GACF;IACD,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC,CAoBA;AAED,wBAAsB,IAAI,CACxB,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,GAAG,EACR,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,UAAU,CAAC,CAoDrB"}

package/build/src/deploy/pull/index.js

@@ -0,0 +1,152 @@
+// `cdk pull` — generate define* source from a live workspace.
+//
+// Pipeline: enumerate (IO) → map (pure) → resolve refs (pure) → print (pure) →
+// write files → adopt into cargo.state.json (reusing importResource, so the very
+// next `cdk deploy` is a no-op instead of duplicate-creating what's already live).
+//
+// Adoption is the default and the safety property: without it, the generated
+// code has no state, so a deploy would re-create resources that already exist.
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { adoptResources } from "../import.js";
+import { loadResources } from "../load.js";
+import { enumerateWorkspace } from "./enumerate.js";
+import { isSecretMarker, SUPPORTED_KINDS } from "./ir.js";
+import { fileAssetPath, mapRow } from "./mappers.js";
+import { printResource } from "./print.js";
+import { resolveResources } from "./resolve.js";
+export { SUPPORTED_KINDS } from "./ir.js";
+// Why a kind's resources may be skipped — static per-kind, surfaced by the CLI
+// next to the skip counts so a gap is never silent.
+export const SKIP_REASONS = {
+    model: "unify models are auto-generated",
+    relationship: "auto-generated by unification",
+    segment: "play-backing segments are managed by their play",
+    customIntegration: "external (baseUrl) integrations have no builder",
+    tool: "read-only or never deployed",
+    mcpServer: "template-installed",
+    agent: "never deployed, or no dedicated LLM connector",
+    file: "content not readable",
+    worker: "never promoted",
+    app: "never promoted",
+    context: "empty repository",
+};
+// Every masked secret's env name, in file order (deduped + sorted).
+function collectEnvNames(resources) {
+    const names = new Set();
+    const walk = (value) => {
+        if (isSecretMarker(value)) {
+            names.add(value.envName);
+            return;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item);
+            return;
+        }
+        if (typeof value === "object" && value !== null) {
+            for (const item of Object.values(value))
+                walk(item);
+        }
+    };
+    for (const resource of resources)
+        walk(resource.spec);
+    return [...names].sort();
+}
+// Disambiguate resources that map to the same `<kind>:<slug>` (e.g. two models
+// named "contacts", or folders whose names slugify alike) so files and export
+// identifiers never collide + silently overwrite. Deterministic: append _2, _3…
+// in input order. Refs still resolve by uuid, so renaming a slug is safe.
+function dedupeSlugs(resources) {
+    const used = new Set();
+    return resources.map((resource) => {
+        let slug = resource.slug;
+        let n = 1;
+        while (used.has(`${resource.kind}:${slug}`)) {
+            n += 1;
+            slug = `${resource.slug}_${String(n)}`;
+        }
+        used.add(`${resource.kind}:${slug}`);
+        return slug === resource.slug ? resource : { ...resource, slug };
+    });
+}
+// After dedupeSlugs may have renamed a file resource, re-derive its single
+// asset path from the final slug so two same-named files don't overwrite each
+// other's content (spec.path references the asset, so both move together).
+// Worker/app assets need no fixup: their slugs are server-unique, so dedupe
+// never renames them.
+function fixupFileAsset(resource) {
+    if (resource.kind !== "file" || resource.assets === undefined) {
+        return resource;
+    }
+    const asset = resource.assets[0];
+    if (asset === undefined)
+        return resource;
+    const path = fileAssetPath(resource.slug, asset.path);
+    if (path === asset.path)
+        return resource;
+    return {
+        ...resource,
+        spec: { ...resource.spec, path },
+        assets: [{ ...asset, path }],
+    };
+}
+// Turn a live workspace into generated files (+ resolved cross-refs), purely.
+// `skipped` counts resources a mapper declined (returned null) per kind.
+export function generateFiles(rows) {
+    const skipped = {};
+    const mapped = [];
+    for (const entry of rows) {
+        const ir = mapRow(entry.kind, entry.row);
+        if (ir === null) {
+            skipped[entry.kind] = (skipped[entry.kind] ?? 0) + 1;
+            continue;
+        }
+        mapped.push(ir);
+    }
+    const resources = dedupeSlugs(mapped).map(fixupFileAsset);
+    const resolved = resolveResources(resources);
+    const files = [
+        ...resolved.map(printResource),
+        ...resources.flatMap((resource) => resource.assets === undefined ? [] : resource.assets),
+    ];
+    return { files, resources, skipped };
+}
+export async function pull(root, api, workspaceUuid, options = {}) {
+    const kinds = options.kinds ?? SUPPORTED_KINDS;
+    const rows = await enumerateWorkspace(api, kinds);
+    const { files, resources, skipped } = generateFiles(rows);
+    const envNames = collectEnvNames(resources);
+    const counts = {};
+    for (const resource of resources) {
+        counts[resource.kind] = (counts[resource.kind] ?? 0) + 1;
+    }
+    if (options.dryRun === true) {
+        return { files, counts, skipped, envNames, adopted: 0 };
+    }
+    for (const file of files) {
+        const abs = join(root, file.path);
+        await mkdir(dirname(abs), { recursive: true });
+        if ("source" in file)
+            await writeFile(abs, file.source, "utf8");
+        else
+            await writeFile(abs, file.bytes);
+    }
+    // The env vars the generated code expects (masked secrets) — an example env
+    // file so the repo is fillable before its first fresh deploy.
+    if (envNames.length > 0) {
+        await writeFile(join(root, ".env.example"), `# Secrets masked by cdk pull — fill in before deploying to a fresh workspace.\n${envNames
+            .map((name) => `${name}=`)
+            .join("\n")}\n`, "utf8");
+    }
+    // Load the just-written project once, then batch-adopt every resource so its
+    // state entry binds code → live uuid and a later deploy sees it as
+    // up-to-date. Atomic: a mid-batch failure writes no state at all.
+    const adopted = options.noAdopt === true
+        ? 0
+        : await adoptResources(root, api, workspaceUuid, resources.map((resource) => ({
+            id: `${resource.kind}:${resource.slug}`,
+            uuid: resource.uuid,
+        })), await loadResources(root));
+    return { files, counts, skipped, envNames, adopted };
+}

package/build/src/deploy/pull/ir.d.ts

@@ -0,0 +1,45 @@
+import type { ResourceKind } from "../../core.js";
+export type RefMarker = {
+    readonly __ref: true;
+    readonly uuid: string;
+    readonly accessor?: string;
+    readonly fallback: unknown;
+};
+export type SecretMarker = {
+    readonly __secret: true;
+    readonly envName: string;
+};
+export type GeneratedAsset = {
+    readonly path: string;
+    readonly bytes: Uint8Array;
+};
+export type IRResource = {
+    readonly kind: ResourceKind;
+    readonly slug: string;
+    readonly uuid: string;
+    readonly spec: Record<string, unknown>;
+    readonly assets?: readonly GeneratedAsset[];
+};
+export declare function isRefMarker(value: unknown): value is RefMarker;
+export declare function isSecretMarker(value: unknown): value is SecretMarker;
+export type CallMarker = {
+    readonly __call: true;
+    readonly fn: string;
+    readonly args: readonly unknown[];
+};
+export declare function isCallMarker(value: unknown): value is CallMarker;
+export declare function call(fn: string, args: readonly unknown[]): CallMarker;
+export declare function ref(uuid: string, fallbackFn: string, options?: {
+    fallbackUuid?: string;
+    accessor?: string;
+    fallbackExpr?: unknown;
+}): RefMarker;
+export type KindMeta = {
+    readonly dir: string;
+    readonly defineFn: string;
+    readonly singleton?: boolean;
+};
+export declare const KIND_META: Partial<Record<ResourceKind, KindMeta>>;
+export declare const SUPPORTED_KINDS: ResourceKind[];
+export declare function toIdentifier(slug: string): string;
+//# sourceMappingURL=ir.d.ts.map

package/build/src/deploy/pull/ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.d.ts","sourceRoot":"","sources":["../../../../src/deploy/pull/ir.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG;IACtB,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC;IAErB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAI3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAKF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;CAC7C,CAAC;AAEF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAM9D;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAMpE;AAKD,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAC;CACnC,CAAC;AAEF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAMhE;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,UAAU,CAErE;AAED,wBAAgB,GAAG,CACjB,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE;IAIP,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,YAAY,CAAC,EAAE,OAAO,CAAC;CACnB,GACL,SAAS,CAQX;AAID,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAoB7D,CAAC;AAEF,eAAO,MAAM,eAAe,gBAA2C,CAAC;AAKxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQjD"}

package/build/src/deploy/pull/ir.js

@@ -0,0 +1,72 @@
+// Intermediate representation for `cdk pull` (live workspace → define* source).
+//
+// A live resource is first mapped to an `IRResource`: its define*-spec fields
+// (create-spec, not the drift-reader's updatable subset), with two kinds of
+// markers embedded wherever a raw value can't be printed as plain JSON:
+//   - `RefMarker`  — a uuid pointing at another resource. `resolve` later turns
+//     it into a code handle (if that resource is also being pulled) or a literal
+//     `xxRef("uuid")`.
+//   - `SecretMarker` — an encrypted credential field. Printed as
+//     `secret("NAME")` (the env-var name, read at apply time); the real value
+//     is never recoverable from the API.
+//
+// map/resolve/print are pure so the whole pipeline is unit-testable from raw
+// API-row fixtures, with no network.
+export function isRefMarker(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value.__ref === true);
+}
+export function isSecretMarker(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value.__secret === true);
+}
+export function isCallMarker(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value.__call === true);
+}
+export function call(fn, args) {
+    return { __call: true, fn, args };
+}
+export function ref(uuid, fallbackFn, options = {}) {
+    const fallback = options.fallbackExpr === undefined
+        ? call(fallbackFn, [
+            options.fallbackUuid === undefined ? uuid : options.fallbackUuid,
+        ])
+        : options.fallbackExpr;
+    return { __ref: true, uuid, accessor: options.accessor, fallback };
+}
+export const KIND_META = {
+    connector: { dir: "connectors", defineFn: "defineConnector" },
+    customIntegration: {
+        dir: "custom-integrations",
+        defineFn: "defineCustomIntegration",
+    },
+    model: { dir: "models", defineFn: "defineModel" },
+    relationship: { dir: "relationships", defineFn: "defineRelationship" },
+    segment: { dir: "segments", defineFn: "defineSegment" },
+    folder: { dir: "folders", defineFn: "defineFolder" },
+    capacity: { dir: "capacities", defineFn: "defineCapacity" },
+    territory: { dir: "territories", defineFn: "defineTerritory" },
+    tool: { dir: "tools", defineFn: "defineTool" },
+    play: { dir: "plays", defineFn: "definePlay" },
+    mcpServer: { dir: "mcp-servers", defineFn: "defineMcpServer" },
+    agent: { dir: "agents", defineFn: "defineAgent" },
+    file: { dir: "files", defineFn: "defineFile" },
+    worker: { dir: "workers", defineFn: "defineWorker" },
+    app: { dir: "apps", defineFn: "defineApp" },
+    context: { dir: "context", defineFn: "defineContext", singleton: true },
+};
+export const SUPPORTED_KINDS = Object.keys(KIND_META);
+// A live slug (snake_case / kebab) → a valid JS identifier for `export const`.
+// camelCases across `-`/`_`, strips other invalid chars, and prefixes a leading
+// digit. Deterministic so imports and exports agree across files.
+export function toIdentifier(slug) {
+    const camel = slug
+        .replace(/[^A-Za-z0-9]+(.)?/g, (_m, c) => c === undefined ? "" : c.toUpperCase())
+        .replace(/[^A-Za-z0-9]/g, "");
+    const safe = camel.length === 0 ? "resource" : camel;
+    return /^[0-9]/.test(safe) ? `r${safe}` : safe;
+}

package/build/src/deploy/pull/mappers.d.ts

@@ -0,0 +1,10 @@
+import type { ResourceKind } from "../../core.js";
+import { type IRResource } from "./ir.js";
+type Row = Record<string, unknown>;
+export declare function fileAssetPath(slug: string, sourceName: string): string;
+type Mapper = (row: Row) => IRResource | null;
+export declare const UNIFY_EXTRACTOR_SLUGS: Set<string>;
+export declare const MAPPERS: Partial<Record<ResourceKind, Mapper>>;
+export declare function mapRow(kind: ResourceKind, row: Row): IRResource | null;
+export {};
+//# sourceMappingURL=mappers.d.ts.map

package/build/src/deploy/pull/mappers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mappers.d.ts","sourceRoot":"","sources":["../../../../src/deploy/pull/mappers.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAEL,KAAK,UAAU,EAMhB,MAAM,SAAS,CAAC;AAEjB,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAoHnC,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGtE;AAGD,KAAK,MAAM,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,UAAU,GAAG,IAAI,CAAC;AAkB9C,eAAO,MAAM,qBAAqB,aAKhC,CAAC;AAmiBH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAiBzD,CAAC;AAEF,wBAAgB,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,GAAG,UAAU,GAAG,IAAI,CAQtE"}