@fjall/generator 0.88.4

package/dist/src/ast/astInfrastructureParser.js

@@ -0,0 +1,1925 @@
+import * as ts from "typescript";
+import { ApplicationResourcePlanSchema, getZodErrorMessage, S3_STACK_PLACEMENTS, } from "../schemas/resourceSchemas.js";
+import { z } from "zod";
+import { constIncludes, S3_ENCRYPTION_TYPES, BACKUP_VAULT_TIERS, } from "../schemas/constants.js";
+import { COST_ALLOCATION_TAG } from "../generation/infrastructure.js";
+import { convertComputeResources } from "./astComputeParser.js";
+const S3_BUCKET_CLASSES = new Set(["S3Bucket"]);
+/** Base check for non-null, non-array objects */
+export function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Type guard for identifier references */
+export function isIdentifierRef(value) {
+    return isPlainObject(value) && "__identifier" in value;
+}
+/** Type guard for expression references */
+export function isExpressionRef(value) {
+    return isPlainObject(value) && "__expression" in value;
+}
+/** Type guard for parsed objects */
+export function isParsedObject(value) {
+    return (isPlainObject(value) &&
+        !("__identifier" in value) &&
+        !("__expression" in value) &&
+        !("__call" in value) &&
+        !("__unknown" in value));
+}
+/** Safely extract a string from ParsedValue */
+export function asString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+/** Safely extract a number from ParsedValue */
+export function asNumber(value) {
+    return typeof value === "number" ? value : undefined;
+}
+/** Safely extract a boolean from ParsedValue */
+export function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+/** Safely extract a string array from ParsedValue */
+export function asStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const result = [];
+    for (const item of value) {
+        if (typeof item === "string")
+            result.push(item);
+    }
+    return result.length > 0 ? result : undefined;
+}
+/** Check if an object literal property is a named property assignment */
+function isNamedProperty(prop, name) {
+    return (ts.isPropertyAssignment(prop) &&
+        ts.isIdentifier(prop.name) &&
+        prop.name.text === name);
+}
+/** Check if a node is an App.getApp() call expression */
+function isAppGetAppCall(node) {
+    return (ts.isCallExpression(node) &&
+        ts.isPropertyAccessExpression(node.expression) &&
+        node.expression.name.text === "getApp" &&
+        ts.isIdentifier(node.expression.expression) &&
+        node.expression.expression.text === "App");
+}
+/** Check if a node is a chained factory method call (e.g., app.addDatabase(...)) */
+function isFactoryMethodCall(node, methodName) {
+    const { expression } = node;
+    return (ts.isPropertyAccessExpression(expression) &&
+        expression.name.text === methodName &&
+        node.arguments.length > 0);
+}
+/** Traverse AST and return the first non-undefined result from the finder. */
+function findFirstInAst(sourceFile, finder) {
+    let result;
+    const visit = (node) => {
+        if (result !== undefined)
+            return;
+        result = finder(node);
+        if (result === undefined)
+            ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return result;
+}
+/** Traverse AST and collect all non-null results from the collector. */
+function collectFromAst(sourceFile, collector) {
+    const results = [];
+    const visit = (node) => {
+        const item = collector(node);
+        if (item !== null)
+            results.push(item);
+        ts.forEachChild(node, visit);
+    };
+    visit(sourceFile);
+    return results;
+}
+const FLOW_LOG_DESTINATIONS = ["cloudwatch", "s3"];
+function asFlowLogDestination(value) {
+    if (value === undefined)
+        return undefined;
+    return FLOW_LOG_DESTINATIONS.includes(value)
+        ? value
+        : undefined;
+}
+function parseDeadLetterQueueConfig(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value === false)
+        return false;
+    if (!isParsedObject(value))
+        return undefined;
+    return omitUndefined({
+        enabled: asBoolean(value.enabled),
+        maxReceiveCount: asNumber(value.maxReceiveCount),
+    });
+}
+/** Safely extract an object or false from ParsedValue */
+function asObjectOrFalse(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (value === false)
+        return false;
+    if (typeof value === "object" && !Array.isArray(value))
+        return value;
+    return undefined;
+}
+function parseBooleanOrConfig(value, cast) {
+    if (value === false)
+        return false;
+    return isParsedObject(value) ? cast(value) : undefined;
+}
+function parseOptionalConfig(value, parser) {
+    return isParsedObject(value) ? parser(value) : undefined;
+}
+/** Extract a named sub-object from a config, returning undefined if not a plain object */
+function extractSubConfig(rawConfig, field, transform) {
+    const value = rawConfig[field];
+    return isParsedObject(value) ? transform(value) : undefined;
+}
+function extractVariableName(node) {
+    const parent = node.parent;
+    if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)) {
+        return parent.name.text;
+    }
+    return undefined;
+}
+/** Identity cast - trusts that parsed CDK output matches the expected shape.
+ * Safe because input is always generated CDK code that was originally validated by Zod schemas. */
+const typed = () => (v) => v;
+/** Narrow a string to a union member, returning undefined if not a valid member */
+export function asStringUnion(value, validValues) {
+    const str = asString(value);
+    if (str === undefined)
+        return undefined;
+    return constIncludes(validValues, str) ? str : undefined;
+}
+/** Returns a shallow copy with all undefined-valued properties removed */
+function omitUndefined(obj) {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/** Reconstruct source text from a parsed AST value for round-trip preservation */
+function parsedValueToSourceText(value) {
+    if (value === null)
+        return "null";
+    if (value === undefined)
+        return "undefined";
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (Array.isArray(value)) {
+        return `[${value.map(parsedValueToSourceText).join(", ")}]`;
+    }
+    if (!isPlainObject(value))
+        return String(value);
+    if (isIdentifierRef(value))
+        return value.__identifier;
+    if (isExpressionRef(value))
+        return value.__expression;
+    if (isCallRef(value))
+        return value.__call;
+    if ("__unknown" in value && typeof value.__unknown === "string")
+        return value.__unknown;
+    const entries = Object.entries(value);
+    if (entries.length === 0)
+        return "{}";
+    const inner = entries
+        .map(([k, v]) => `${k}: ${parsedValueToSourceText(v)}`)
+        .join(", ");
+    return `{ ${inner} }`;
+}
+/** Type guard for call references */
+export function isCallRef(value) {
+    return isPlainObject(value) && "__call" in value;
+}
+/** Capture properties from a parsed config that are NOT in the known keys set */
+export function captureExtraProperties(config, knownKeys) {
+    const extras = [];
+    for (const [key, value] of Object.entries(config)) {
+        if (knownKeys.has(key) || value === undefined)
+            continue;
+        extras.push({ key, sourceText: parsedValueToSourceText(value) });
+    }
+    return extras;
+}
+const DYNAMODB_KEY_TYPES = ["S", "N", "B"];
+export function parseInfrastructure(content, options) {
+    const sourceFile = ts.createSourceFile("infrastructure.ts", content, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const imports = extractImports(sourceFile);
+    const { appVariableName, appName } = findAppVariable(sourceFile);
+    const vpcId = findVpcId(sourceFile);
+    const network = findNetworkConfig(sourceFile);
+    const backup = findBackupConfig(sourceFile);
+    const tunnel = findTunnelConfig(sourceFile);
+    const networkResources = findNetworkResources(sourceFile);
+    const allDatabaseResources = findDatabaseResources(sourceFile);
+    const { databases: databaseResources, dynamodb: dynamodbResources } = splitDynamoDBFromDatabases(allDatabaseResources);
+    const sqsResources = findSQSResources(sourceFile);
+    const cdnResource = findCDNResource(sourceFile);
+    const s3Resources = [
+        ...findS3Resources(sourceFile),
+        ...findS3FactoryResources(sourceFile),
+    ];
+    const computeResources = findComputeResources(sourceFile);
+    const patternResources = findPatternResources(sourceFile);
+    const tags = extractTags(sourceFile);
+    const result = {
+        sourceFile,
+        imports,
+        appVariableName,
+        appName,
+        vpcId,
+        network,
+        backup,
+        tunnel,
+        networkResources,
+        databaseResources,
+        dynamodbResources,
+        sqsResources,
+        cdnResource,
+        s3Resources,
+        computeResources,
+        patternResources,
+        tags,
+    };
+    if (options?.extractCustomCode) {
+        result.customCodeBlocks = extractCustomCodeBlocks(sourceFile);
+        result.classifiedStatements = classifyStatements(sourceFile);
+    }
+    return result;
+}
+function extractImports(sourceFile) {
+    const imports = [];
+    ts.forEachChild(sourceFile, (node) => {
+        if (ts.isImportDeclaration(node)) {
+            if (!ts.isStringLiteral(node.moduleSpecifier))
+                return;
+            const moduleSpecifier = node.moduleSpecifier.text;
+            const importInfo = {
+                moduleSpecifier,
+                namedImports: [],
+            };
+            if (node.importClause) {
+                if (node.importClause.name) {
+                    importInfo.defaultImport = node.importClause.name.text;
+                }
+                if (node.importClause.namedBindings &&
+                    ts.isNamedImports(node.importClause.namedBindings)) {
+                    importInfo.namedImports =
+                        node.importClause.namedBindings.elements.map((element) => element.name.text);
+                }
+            }
+            imports.push(importInfo);
+        }
+    });
+    return imports;
+}
+/** Resolve the app name from the first argument of App.getApp(). */
+function resolveAppName(sourceFile, arg) {
+    if (ts.isStringLiteral(arg))
+        return arg.text;
+    if (ts.isIdentifier(arg))
+        return findVariableValue(sourceFile, arg.text) ?? "";
+    if (ts.isPropertyAccessExpression(arg))
+        return evaluatePropertyAccess(sourceFile, arg) ?? "";
+    return "";
+}
+function findAppVariable(sourceFile) {
+    return (findFirstInAst(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node))
+            return undefined;
+        for (const declaration of node.declarationList.declarations) {
+            if (!declaration.initializer ||
+                !isAppGetAppCall(declaration.initializer))
+                continue;
+            const varName = ts.isIdentifier(declaration.name)
+                ? declaration.name.text
+                : "";
+            const appName = declaration.initializer.arguments.length > 0
+                ? resolveAppName(sourceFile, declaration.initializer.arguments[0])
+                : "";
+            return { appVariableName: varName, appName };
+        }
+        return undefined;
+    }) ?? { appVariableName: "", appName: "" });
+}
+function findVpcId(sourceFile) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!isAppGetAppCall(node) || node.arguments.length <= 1)
+            return undefined;
+        const optionsArg = node.arguments[1];
+        if (!ts.isObjectLiteralExpression(optionsArg))
+            return undefined;
+        for (const prop of optionsArg.properties) {
+            if (isNamedProperty(prop, "network") &&
+                ts.isObjectLiteralExpression(prop.initializer)) {
+                for (const networkProp of prop.initializer.properties) {
+                    if (isNamedProperty(networkProp, "useExisting") &&
+                        ts.isStringLiteral(networkProp.initializer)) {
+                        return networkProp.initializer.text;
+                    }
+                }
+            }
+        }
+        return undefined;
+    });
+}
+function parseNetworkConfigFields(parsed) {
+    return {
+        maxAzs: asNumber(parsed.maxAzs),
+        natGateways: parseBooleanOrConfig(parsed.natGateways, (v) => ({
+            count: asNumber(v.count),
+        })),
+        flowLogs: parseBooleanOrConfig(parsed.flowLogs, (v) => ({
+            destination: asString(v.destination),
+            retentionDays: asNumber(v.retentionDays),
+        })),
+        vpcEndpoints: isParsedObject(parsed.vpcEndpoints)
+            ? parsed.vpcEndpoints
+            : undefined,
+    };
+}
+/**
+ * Extract the network configuration from App.getApp() options.
+ * This extracts the network config object (not useExisting, which is handled by findVpcId).
+ */
+function findNetworkConfig(sourceFile) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!isAppGetAppCall(node) || node.arguments.length <= 1)
+            return undefined;
+        const optionsArg = node.arguments[1];
+        if (!ts.isObjectLiteralExpression(optionsArg))
+            return undefined;
+        for (const prop of optionsArg.properties) {
+            if (isNamedProperty(prop, "network")) {
+                if (prop.initializer.kind === ts.SyntaxKind.FalseKeyword)
+                    return undefined;
+                if (ts.isObjectLiteralExpression(prop.initializer)) {
+                    const hasUseExisting = prop.initializer.properties.some((p) => isNamedProperty(p, "useExisting"));
+                    if (!hasUseExisting) {
+                        const parsed = parseObjectLiteral(prop.initializer);
+                        return parseNetworkConfigFields(parsed);
+                    }
+                }
+            }
+        }
+        return undefined;
+    });
+}
+/**
+ * Extract the backup configuration from App.getApp() options.
+ * Returns { tier: string } when backup is configured, false when explicitly disabled, undefined when absent.
+ */
+function findBackupConfig(sourceFile) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!isAppGetAppCall(node) || node.arguments.length <= 1)
+            return undefined;
+        const optionsArg = node.arguments[1];
+        if (!ts.isObjectLiteralExpression(optionsArg))
+            return undefined;
+        for (const prop of optionsArg.properties) {
+            if (isNamedProperty(prop, "backup")) {
+                if (prop.initializer.kind === ts.SyntaxKind.FalseKeyword)
+                    return false;
+                if (ts.isObjectLiteralExpression(prop.initializer)) {
+                    const parsed = parseObjectLiteral(prop.initializer);
+                    const tier = asString(parsed.tier);
+                    if (tier)
+                        return { tier };
+                }
+            }
+        }
+        return undefined;
+    });
+}
+/**
+ * Extract the tunnel configuration from App.getApp() options.
+ * Returns true when `tunnel: true`, { instanceType?: string } when object, false when explicitly disabled, undefined when absent.
+ */
+function findTunnelConfig(sourceFile) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!isAppGetAppCall(node) || node.arguments.length <= 1)
+            return undefined;
+        const optionsArg = node.arguments[1];
+        if (!ts.isObjectLiteralExpression(optionsArg))
+            return undefined;
+        for (const prop of optionsArg.properties) {
+            if (isNamedProperty(prop, "tunnel")) {
+                if (prop.initializer.kind === ts.SyntaxKind.FalseKeyword)
+                    return false;
+                if (prop.initializer.kind === ts.SyntaxKind.TrueKeyword)
+                    return true;
+                if (ts.isObjectLiteralExpression(prop.initializer)) {
+                    const parsed = parseObjectLiteral(prop.initializer);
+                    const instanceType = asString(parsed.instanceType);
+                    if (instanceType)
+                        return { instanceType };
+                    return {};
+                }
+            }
+        }
+        return undefined;
+    });
+}
+/** Type guard for Factory.build() call expressions */
+function isFactoryBuildCall(node, factoryName) {
+    return (ts.isCallExpression(node) &&
+        ts.isPropertyAccessExpression(node.expression) &&
+        node.expression.name.text === "build" &&
+        ts.isIdentifier(node.expression.expression) &&
+        node.expression.expression.text === factoryName);
+}
+/**
+ * Find all app.addNetwork() calls and extract their configuration.
+ */
+function findNetworkResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addNetwork"))
+            return null;
+        const networkArg = node.arguments[0];
+        if (!isFactoryBuildCall(networkArg, "NetworkFactory"))
+            return null;
+        return extractNetworkResource(node, networkArg);
+    });
+}
+/**
+ * Extract a network resource from a NetworkFactory.build() call.
+ */
+function extractNetworkResource(addNetworkCall, buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg))
+        return null;
+    const name = nameArg.text;
+    const parsed = ts.isObjectLiteralExpression(configArg)
+        ? parseObjectLiteral(configArg)
+        : {};
+    const networkFields = parseNetworkConfigFields(parsed);
+    const resource = {
+        name,
+        config: omitUndefined({ ...networkFields }),
+        node: addNetworkCall,
+    };
+    const varName = extractVariableName(addNetworkCall);
+    if (varName)
+        resource.variableName = varName;
+    return resource;
+}
+function findVariableValue(sourceFile, varName) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node))
+            return undefined;
+        for (const declaration of node.declarationList.declarations) {
+            if (ts.isIdentifier(declaration.name) &&
+                declaration.name.text === varName &&
+                declaration.initializer) {
+                if (ts.isStringLiteral(declaration.initializer)) {
+                    return declaration.initializer.text;
+                }
+                if (ts.isObjectLiteralExpression(declaration.initializer)) {
+                    const obj = parseObjectLiteral(declaration.initializer);
+                    return JSON.stringify(obj);
+                }
+            }
+        }
+        return undefined;
+    });
+}
+function findObjectDeclaration(sourceFile, objName) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!ts.isVariableStatement(node))
+            return undefined;
+        for (const declaration of node.declarationList.declarations) {
+            if (ts.isIdentifier(declaration.name) &&
+                declaration.name.text === objName &&
+                declaration.initializer &&
+                ts.isObjectLiteralExpression(declaration.initializer)) {
+                return parseObjectLiteral(declaration.initializer);
+            }
+        }
+        return undefined;
+    });
+}
+function evaluatePropertyAccess(sourceFile, node) {
+    if (!ts.isIdentifier(node.expression))
+        return undefined;
+    const objValue = findObjectDeclaration(sourceFile, node.expression.text);
+    const propName = node.name.text;
+    if (objValue && objValue[propName] !== undefined) {
+        return String(objValue[propName]);
+    }
+    return undefined;
+}
+/** Derive database engine from parsed config */
+function extractDatabaseEngine(config) {
+    const directEngine = asString(config.databaseEngine);
+    if (directEngine === "postgresql" || directEngine === "mysql")
+        return directEngine;
+    // Derive from engine expression (e.g. DatabaseInstanceEngine.postgres(...))
+    const engine = config.engine;
+    if (isCallRef(engine)) {
+        const callText = String(engine.__call);
+        if (callText.includes("postgres") || callText.includes("auroraPostgres")) {
+            return "postgresql";
+        }
+        if (callText.includes("mysql") || callText.includes("auroraMysql")) {
+            return "mysql";
+        }
+    }
+    return undefined;
+}
+/** Extract raw engine expression text (e.g. "DatabaseInstanceEngine.postgres(...)") */
+function extractEngineExpression(config) {
+    const engine = config.engine;
+    if (isCallRef(engine)) {
+        return String(engine.__call);
+    }
+    return undefined;
+}
+/**
+ * Resolve a template literal expression to its string value.
+ * Walks spans: head.text + resolve each span.expression + span.literal.text.
+ * Falls back to stripping backticks from getText() if resolution fails.
+ */
+function resolveTemplateLiteral(sourceFile, templateExpr) {
+    let result = templateExpr.head.text;
+    for (const span of templateExpr.templateSpans) {
+        if (ts.isIdentifier(span.expression)) {
+            const resolved = findVariableValue(sourceFile, span.expression.text);
+            if (resolved) {
+                result += resolved;
+            }
+            else {
+                // Can't resolve — fall back to raw getText()
+                return templateExpr.getText(sourceFile).replace(/^`|`$/g, "");
+            }
+        }
+        else if (ts.isPropertyAccessExpression(span.expression)) {
+            const resolved = evaluatePropertyAccess(sourceFile, span.expression);
+            if (resolved) {
+                result += resolved;
+            }
+            else {
+                return templateExpr.getText(sourceFile).replace(/^`|`$/g, "");
+            }
+        }
+        else {
+            return templateExpr.getText(sourceFile).replace(/^`|`$/g, "");
+        }
+        result += span.literal.text;
+    }
+    return result;
+}
+function findDatabaseResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addDatabase"))
+            return null;
+        const databaseArg = node.arguments[0];
+        if (!isFactoryBuildCall(databaseArg, "DatabaseFactory"))
+            return null;
+        return extractDatabaseResource(sourceFile, node, databaseArg);
+    });
+}
+function extractDatabaseResource(sourceFile, addDatabaseCall, buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg) && !ts.isTemplateExpression(nameArg)) {
+        return null;
+    }
+    const resourceName = ts.isStringLiteral(nameArg)
+        ? nameArg.text
+        : resolveTemplateLiteral(sourceFile, nameArg);
+    if (!ts.isObjectLiteralExpression(configArg)) {
+        return null;
+    }
+    const config = parseObjectLiteral(configArg);
+    const resource = {
+        resourceName,
+        type: asString(config.type) ?? "",
+        databaseName: asString(config.databaseName) ?? "",
+        databaseEngine: extractDatabaseEngine(config),
+        engineExpression: extractEngineExpression(config),
+        port: asNumber(config.port),
+        deletionProtection: asBoolean(config.deletionProtection),
+        instanceType: asString(config.instanceType),
+        multiAz: asBoolean(config.multiAz),
+        publiclyAccessible: asBoolean(config.publiclyAccessible),
+        enableSecretRotation: asBoolean(config.enableSecretRotation),
+        encryption: parseOptionalConfig(config.encryption, typed()),
+        databaseInsights: parseBooleanOrConfig(config.databaseInsights, typed()),
+        proxy: parseBooleanOrConfig(config.proxy, typed()),
+        readReplica: parseBooleanOrConfig(config.readReplica, typed()),
+        credentials: parseOptionalConfig(config.credentials, typed()),
+        writer: parseOptionalConfig(config.writer, typed()),
+        readers: parseBooleanOrConfig(config.readers, typed()),
+        backupRetention: asNumber(config.backupRetention),
+        preferredMaintenanceWindow: asString(config.preferredMaintenanceWindow),
+        primaryRegion: asString(config.primaryRegion),
+        secondaryRegions: asStringArray(config.secondaryRegions),
+        globalClusterIdentifier: asString(config.globalClusterIdentifier),
+        enableGlobalWriteForwarding: asBoolean(config.enableGlobalWriteForwarding),
+        snapshotIdentifier: asString(config.snapshotIdentifier),
+        snapshotUsername: asString(config.snapshotUsername),
+        node: addDatabaseCall,
+    };
+    const varName = extractVariableName(addDatabaseCall);
+    if (varName)
+        resource.variableName = varName;
+    const DATABASE_KNOWN_KEYS = new Set([
+        "type",
+        "databaseName",
+        "databaseEngine",
+        "engine",
+        "vpc",
+        "port",
+        "deletionProtection",
+        "instanceType",
+        "multiAz",
+        "publiclyAccessible",
+        "enableSecretRotation",
+        "encryption",
+        "databaseInsights",
+        "proxy",
+        "readReplica",
+        "credentials",
+        "writer",
+        "readers",
+        "backupRetention",
+        "preferredMaintenanceWindow",
+        "primaryRegion",
+        "secondaryRegions",
+        "globalClusterIdentifier",
+        "enableGlobalWriteForwarding",
+        "snapshotIdentifier",
+        "snapshotUsername",
+    ]);
+    const extras = captureExtraProperties(config, DATABASE_KNOWN_KEYS);
+    if (extras.length > 0)
+        resource.extraProperties = extras;
+    return resource;
+}
+function findS3Resources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isVariableDeclaration(node) || !node.initializer)
+            return null;
+        if (!ts.isNewExpression(node.initializer))
+            return null;
+        const newExpr = node.initializer;
+        if (!ts.isIdentifier(newExpr.expression))
+            return null;
+        const bucketClass = newExpr.expression.text;
+        if (!S3_BUCKET_CLASSES.has(bucketClass))
+            return null;
+        return extractS3Resource(node, newExpr, bucketClass);
+    });
+}
+function extractS3Resource(varDecl, newExpr, bucketClass) {
+    const variableName = ts.isIdentifier(varDecl.name) ? varDecl.name.text : "";
+    if (newExpr.arguments && newExpr.arguments.length >= 2) {
+        const nameArg = newExpr.arguments[1];
+        const resourceName = ts.isStringLiteral(nameArg) ? nameArg.text : "";
+        const configArg = newExpr.arguments.length >= 3 ? newExpr.arguments[2] : undefined;
+        const config = configArg && ts.isObjectLiteralExpression(configArg)
+            ? parseObjectLiteral(configArg)
+            : {};
+        return {
+            variableName,
+            resourceName,
+            bucketClass,
+            config,
+            node: varDecl,
+        };
+    }
+    return null;
+}
+/** Find S3 resources created via app.addStorage(StorageFactory.build(...)) factory pattern */
+function findS3FactoryResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addStorage"))
+            return null;
+        const storageArg = node.arguments[0];
+        if (!isFactoryBuildCall(storageArg, "StorageFactory"))
+            return null;
+        return extractS3FactoryResource(node, storageArg);
+    });
+}
+function extractS3FactoryResource(addStorageCall, buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg) || !ts.isObjectLiteralExpression(configArg))
+        return null;
+    const config = parseObjectLiteral(configArg);
+    const variableName = extractVariableName(addStorageCall) ?? "";
+    return {
+        variableName,
+        resourceName: nameArg.text,
+        bucketClass: "StorageFactory",
+        config,
+        node: addStorageCall,
+    };
+}
+function findComputeResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addCompute"))
+            return null;
+        const computeArg = node.arguments[0];
+        if (!isFactoryBuildCall(computeArg, "ComputeFactory"))
+            return null;
+        const resource = extractComputeResource(computeArg);
+        if (resource) {
+            const varName = extractVariableName(node);
+            if (varName)
+                resource.variableName = varName;
+        }
+        return resource;
+    });
+}
+function findSQSResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) ||
+            !isFactoryMethodCall(node, "addMessaging"))
+            return null;
+        const messagingArg = node.arguments[0];
+        if (!isFactoryBuildCall(messagingArg, "MessagingFactory"))
+            return null;
+        return extractSQSResource(node, messagingArg);
+    });
+}
+function extractSQSResource(addMessagingCall, buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg) ||
+        !ts.isObjectLiteralExpression(configArg)) {
+        return null;
+    }
+    const config = parseObjectLiteral(configArg);
+    const resource = {
+        resourceName: nameArg.text,
+        queueType: asString(config.queueType) ?? "standard",
+        visibilityTimeout: asNumber(config.visibilityTimeout),
+        retentionPeriod: asNumber(config.messageRetentionPeriod),
+        contentBasedDeduplication: asBoolean(config.contentBasedDeduplication),
+        node: addMessagingCall,
+    };
+    const varName = extractVariableName(addMessagingCall);
+    if (varName)
+        resource.variableName = varName;
+    const SQS_KNOWN_KEYS = new Set([
+        "type",
+        "queueType",
+        "visibilityTimeout",
+        "messageRetentionPeriod",
+        "contentBasedDeduplication",
+    ]);
+    const extras = captureExtraProperties(config, SQS_KNOWN_KEYS);
+    if (extras.length > 0)
+        resource.extraProperties = extras;
+    return resource;
+}
+function findCDNResource(sourceFile) {
+    return findFirstInAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addCdn"))
+            return undefined;
+        const cdnArg = node.arguments[0];
+        if (!isFactoryBuildCall(cdnArg, "CdnFactory"))
+            return undefined;
+        return extractCDNResource(cdnArg) ?? undefined;
+    });
+}
+function extractCDNResource(buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg) ||
+        !ts.isObjectLiteralExpression(configArg)) {
+        return null;
+    }
+    return {
+        resourceName: nameArg.text,
+        config: parseObjectLiteral(configArg),
+        node: buildCall,
+    };
+}
+function extractComputeResource(buildCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const nameArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(nameArg) ||
+        !ts.isObjectLiteralExpression(configArg)) {
+        return null;
+    }
+    const resourceName = nameArg.text;
+    const config = parseObjectLiteral(configArg);
+    return {
+        resourceName,
+        type: asString(config.type) ?? "ecs",
+        config,
+        node: buildCall,
+    };
+}
+/**
+ * Find pattern resources from app.addPattern(PatternFactory.build(...)) calls.
+ * Patterns are high-level constructs that encapsulate multiple resources.
+ */
+function findPatternResources(sourceFile) {
+    return collectFromAst(sourceFile, (node) => {
+        if (!ts.isCallExpression(node) || !isFactoryMethodCall(node, "addPattern"))
+            return null;
+        const patternArg = node.arguments[0];
+        if (!isFactoryBuildCall(patternArg, "PatternFactory"))
+            return null;
+        return extractPatternResource(patternArg, node);
+    });
+}
+function parseLambdaConfig(obj) {
+    if (!isParsedObject(obj))
+        return undefined;
+    const config = {
+        ...(obj.memorySize !== undefined && {
+            memorySize: asNumber(obj.memorySize),
+        }),
+        ...(obj.timeout !== undefined && { timeout: asNumber(obj.timeout) }),
+        ...(obj.ephemeralStorageSize !== undefined && {
+            ephemeralStorageSize: asNumber(obj.ephemeralStorageSize),
+        }),
+    };
+    return Object.keys(config).length > 0 ? config : undefined;
+}
+const VALID_DB_TYPES = ["Instance", "Aurora", "GlobalAurora"];
+const VALID_NON_GLOBAL_DB_TYPES = ["Instance", "Aurora"];
+const VALID_DB_ENGINES = ["postgresql", "mysql"];
+function extractPatternDatabaseConfig(rawConfig) {
+    return extractSubConfig(rawConfig, "database", (db) => ({
+        type: asStringUnion(db.type, VALID_NON_GLOBAL_DB_TYPES),
+        databaseName: asString(db.databaseName),
+        databaseEngine: asStringUnion(db.databaseEngine, VALID_DB_ENGINES),
+        deletionProtection: asBoolean(db.deletionProtection),
+        backupRetention: asNumber(db.backupRetention),
+        port: asNumber(db.port),
+        publiclyAccessible: asBoolean(db.publiclyAccessible),
+        allowedIpCidr: asString(db.allowedIpCidr),
+        instanceType: asString(db.instanceType),
+        allocatedStorage: asNumber(db.allocatedStorage),
+        multiAz: asBoolean(db.multiAz),
+        allowVpcAccess: asBoolean(db.allowVpcAccess),
+        monitoringInterval: asNumber(db.monitoringInterval),
+        preferredMaintenanceWindow: asString(db.preferredMaintenanceWindow),
+        snapshotIdentifier: asString(db.snapshotIdentifier),
+        snapshotUsername: asString(db.snapshotUsername),
+        readReplica: asObjectOrFalse(db.readReplica),
+        writer: parseOptionalConfig(db.writer, typed()),
+        readers: asObjectOrFalse(db.readers),
+        databaseInsights: asObjectOrFalse(db.databaseInsights),
+        proxy: asObjectOrFalse(db.proxy),
+        credentials: parseOptionalConfig(db.credentials, typed()),
+        encryption: parseOptionalConfig(db.encryption, typed()),
+    }));
+}
+function extractPatternComputeConfig(rawConfig) {
+    return extractSubConfig(rawConfig, "compute", (compute) => ({
+        server: parseOptionalConfig(compute.server, parseLambdaConfig),
+        imageOptimisation: parseOptionalConfig(compute.imageOptimisation, parseLambdaConfig),
+        revalidation: parseOptionalConfig(compute.revalidation, parseLambdaConfig),
+    }));
+}
+function extractPatternStorageConfig(rawConfig) {
+    const parseVersionedConfig = (obj) => ({
+        versioned: asBoolean(obj.versioned),
+    });
+    return extractSubConfig(rawConfig, "storage", (storage) => ({
+        assets: parseOptionalConfig(storage.assets, parseVersionedConfig),
+        cache: parseOptionalConfig(storage.cache, parseVersionedConfig),
+        media: parseOptionalConfig(storage.media, parseVersionedConfig),
+    }));
+}
+function extractPatternMessagingConfig(rawConfig) {
+    return extractSubConfig(rawConfig, "messaging", (messaging) => ({
+        revalidationQueue: parseOptionalConfig(messaging.revalidationQueue, (queue) => ({
+            visibilityTimeout: asNumber(queue.visibilityTimeout),
+            messageRetentionPeriod: asNumber(queue.messageRetentionPeriod),
+            maxMessageSize: asNumber(queue.maxMessageSize),
+            deadLetterQueue: parseDeadLetterQueueConfig(queue.deadLetterQueue),
+        })),
+    }));
+}
+function extractPatternCdnConfig(rawConfig) {
+    return extractSubConfig(rawConfig, "cdn", (cdn) => ({
+        domainNames: asStringArray(cdn.domainNames),
+        certificateArn: asString(cdn.certificateArn),
+    }));
+}
+function extractPatternEnvironmentConfig(rawConfig) {
+    return extractSubConfig(rawConfig, "environment", (env) => {
+        const environment = Object.fromEntries(Object.entries(env).filter((entry) => typeof entry[1] === "string"));
+        return Object.keys(environment).length > 0 ? environment : undefined;
+    });
+}
+/**
+ * Extract pattern resource details from PatternFactory.build() call.
+ */
+function extractPatternResource(buildCall, addPatternCall) {
+    if (buildCall.arguments.length < 2)
+        return null;
+    const constructIdArg = buildCall.arguments[0];
+    const configArg = buildCall.arguments[1];
+    if (!ts.isStringLiteral(constructIdArg) ||
+        !ts.isObjectLiteralExpression(configArg)) {
+        return null;
+    }
+    const constructId = constructIdArg.text;
+    const rawConfig = parseObjectLiteral(configArg);
+    const patternType = rawConfig.type;
+    if (patternType !== "payload" && patternType !== "nextjs") {
+        return null;
+    }
+    const variableName = extractVariableName(addPatternCall);
+    const name = asString(rawConfig.name);
+    if (!name) {
+        return null;
+    }
+    return {
+        variableName,
+        constructId,
+        type: patternType,
+        config: {
+            name,
+            domain: asString(rawConfig.domain),
+            database: extractPatternDatabaseConfig(rawConfig),
+            compute: extractPatternComputeConfig(rawConfig),
+            storage: extractPatternStorageConfig(rawConfig),
+            messaging: extractPatternMessagingConfig(rawConfig),
+            cdn: extractPatternCdnConfig(rawConfig),
+            environment: extractPatternEnvironmentConfig(rawConfig),
+        },
+        node: buildCall,
+    };
+}
+function parseObjectLiteral(node) {
+    const result = {};
+    for (const prop of node.properties) {
+        if (!ts.isPropertyAssignment(prop))
+            continue;
+        const key = ts.isIdentifier(prop.name)
+            ? prop.name.text
+            : ts.isStringLiteral(prop.name)
+                ? prop.name.text
+                : undefined;
+        if (key === undefined)
+            continue;
+        result[key] = evaluateExpression(prop.initializer);
+    }
+    return result;
+}
+function evaluateExpression(node) {
+    if (ts.isStringLiteral(node)) {
+        return node.text;
+    }
+    else if (ts.isNumericLiteral(node)) {
+        return Number(node.text);
+    }
+    else if (node.kind === ts.SyntaxKind.TrueKeyword) {
+        return true;
+    }
+    else if (node.kind === ts.SyntaxKind.FalseKeyword) {
+        return false;
+    }
+    else if (ts.isArrayLiteralExpression(node)) {
+        return node.elements.map((element) => evaluateExpression(element));
+    }
+    else if (ts.isObjectLiteralExpression(node)) {
+        return parseObjectLiteral(node);
+    }
+    else if (ts.isIdentifier(node)) {
+        return { __identifier: node.text };
+    }
+    else if (ts.isPropertyAccessExpression(node)) {
+        return { __expression: node.getText() };
+    }
+    else if (ts.isCallExpression(node)) {
+        return { __call: node.getText() };
+    }
+    else if (ts.isBinaryExpression(node) &&
+        node.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+        // Handle || operator - return the left side if it's a literal
+        const left = evaluateExpression(node.left);
+        const right = evaluateExpression(node.right);
+        // For simplicity, prefer string literals from the right side for defaults
+        if (typeof right === "string") {
+            return right;
+        }
+        return left;
+    }
+    else if (ts.isConditionalExpression(node)) {
+        // Handle ternary operator - for simplicity, try to evaluate the branches
+        const whenTrue = evaluateExpression(node.whenTrue);
+        const whenFalse = evaluateExpression(node.whenFalse);
+        // Default to the false branch for simplicity
+        if (typeof whenFalse === "string" || typeof whenFalse === "number") {
+            return whenFalse;
+        }
+        return whenTrue;
+    }
+    else if (ts.isTemplateExpression(node) ||
+        ts.isNoSubstitutionTemplateLiteral(node)) {
+        // Handle template literals to preserve them as expressions during round-trip parsing
+        return { __expression: node.getText() };
+    }
+    return { __unknown: node.getText() };
+}
+function extractTags(sourceFile) {
+    const tags = {};
+    function visit(node) {
+        if (ts.isCallExpression(node) &&
+            ts.isPropertyAccessExpression(node.expression) &&
+            node.expression.name.text === "addTags" &&
+            ts.isIdentifier(node.expression.expression) &&
+            node.arguments.length > 0) {
+            const tagsArg = node.arguments[0];
+            if (ts.isObjectLiteralExpression(tagsArg)) {
+                const parsedTags = parseObjectLiteral(tagsArg);
+                for (const [key, value] of Object.entries(parsedTags)) {
+                    if (typeof value === "string") {
+                        tags[key] = value;
+                    }
+                    else if (isExpressionRef(value)) {
+                        // process.env tag expressions can't be statically resolved; use placeholder
+                        tags[key] = "default-value";
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return tags;
+}
+/** Builds the conditional spread fields shared by primary and additional network configs */
+function buildNetworkFields(config) {
+    const flowLogs = config.flowLogs;
+    return {
+        ...omitUndefined({
+            maxAzs: config.maxAzs,
+            natGateways: config.natGateways,
+            vpcEndpoints: config.vpcEndpoints,
+        }),
+        ...(flowLogs !== undefined && {
+            flowLogs: flowLogs === false
+                ? false
+                : omitUndefined({
+                    destination: asFlowLogDestination(flowLogs.destination),
+                    retentionDays: flowLogs.retentionDays,
+                }),
+        }),
+    };
+}
+function convertNetworkConfig(parsed) {
+    if (!parsed.network)
+        return undefined;
+    return buildNetworkFields(parsed.network);
+}
+function convertBackupConfig(parsed) {
+    if (parsed.backup === undefined)
+        return undefined;
+    if (parsed.backup === false)
+        return false;
+    const tier = parsed.backup.tier;
+    if (constIncludes(BACKUP_VAULT_TIERS, tier)) {
+        return { tier: tier };
+    }
+    return undefined;
+}
+function convertTunnelConfig(parsed) {
+    if (parsed.tunnel === undefined)
+        return undefined;
+    if (parsed.tunnel === false)
+        return false;
+    if (parsed.tunnel === true)
+        return {};
+    const result = {};
+    if (parsed.tunnel.instanceType) {
+        result.instanceType = parsed.tunnel.instanceType;
+    }
+    return result;
+}
+/** Parse a DynamoDB key schema from parsed AST object */
+function parseDynamoDBKey(value) {
+    if (!isParsedObject(value))
+        return undefined;
+    const name = asString(value.name);
+    const type = asStringUnion(value.type, DYNAMODB_KEY_TYPES);
+    if (!name || !type)
+        return undefined;
+    return { name, type };
+}
+/** Split DynamoDB resources (type: "DynamoDB") from regular database resources */
+function splitDynamoDBFromDatabases(allResources) {
+    const databases = [];
+    const dynamodb = [];
+    for (const resource of allResources) {
+        if (resource.type === "DynamoDB") {
+            const dynamo = extractDynamoDBFields(resource);
+            if (dynamo)
+                dynamodb.push(dynamo);
+        }
+        else {
+            databases.push(resource);
+        }
+    }
+    return { databases, dynamodb };
+}
+/** Extract DynamoDB-specific fields from a parsed database resource */
+function extractDynamoDBFields(resource) {
+    // Re-read the raw config from the AST node to get DynamoDB-specific fields
+    // The resource was extracted by extractDatabaseResource which parsed the full config
+    const node = resource.node;
+    if (!ts.isCallExpression(node))
+        return null;
+    const buildCallArg = node.arguments[0];
+    if (!ts.isCallExpression(buildCallArg) || buildCallArg.arguments.length < 2)
+        return null;
+    const configArg = buildCallArg.arguments[1];
+    if (!ts.isObjectLiteralExpression(configArg))
+        return null;
+    const config = parseObjectLiteral(configArg);
+    const partitionKey = parseDynamoDBKey(config.partitionKey);
+    if (!partitionKey)
+        return null;
+    const result = {
+        resourceName: resource.resourceName,
+        partitionKey,
+        node: resource.node,
+    };
+    if (resource.variableName)
+        result.variableName = resource.variableName;
+    const sortKey = parseDynamoDBKey(config.sortKey);
+    if (sortKey)
+        result.sortKey = sortKey;
+    if (Array.isArray(config.globalSecondaryIndexes)) {
+        const gsis = config.globalSecondaryIndexes
+            .filter(isParsedObject)
+            .map((gsi) => {
+            const pk = parseDynamoDBKey(gsi.partitionKey);
+            if (!pk)
+                return null;
+            const indexName = asString(gsi.indexName);
+            if (!indexName)
+                return null;
+            const entry = { indexName, partitionKey: pk };
+            const sk = parseDynamoDBKey(gsi.sortKey);
+            if (sk)
+                entry.sortKey = sk;
+            return entry;
+        })
+            .filter((g) => g !== null);
+        if (gsis.length > 0)
+            result.globalSecondaryIndexes = gsis;
+    }
+    const ttlAttribute = asString(config.ttlAttribute);
+    if (ttlAttribute)
+        result.ttlAttribute = ttlAttribute;
+    const stream = asBoolean(config.stream);
+    if (stream !== undefined)
+        result.stream = stream;
+    const DYNAMODB_KNOWN_KEYS = new Set([
+        "type",
+        "databaseName",
+        "partitionKey",
+        "sortKey",
+        "globalSecondaryIndexes",
+        "ttlAttribute",
+        "stream",
+    ]);
+    const extras = captureExtraProperties(config, DYNAMODB_KNOWN_KEYS);
+    if (extras.length > 0)
+        result.extraProperties = extras;
+    return result;
+}
+/** Convert parsed DynamoDB resources to plan format */
+function convertDynamoDBResources(parsed) {
+    if (parsed.dynamodbResources.length === 0)
+        return undefined;
+    return parsed.dynamodbResources.map((table) => ({
+        name: table.resourceName,
+        partitionKey: table.partitionKey,
+        ...omitUndefined({
+            sortKey: table.sortKey,
+            globalSecondaryIndexes: table.globalSecondaryIndexes,
+            ttlAttribute: table.ttlAttribute,
+            stream: table.stream,
+            variableName: table.variableName,
+            extraProperties: table.extraProperties,
+        }),
+    }));
+}
+/** Convert parsed SQS resources to plan format */
+function convertSQSResources(parsed) {
+    if (parsed.sqsResources.length === 0)
+        return undefined;
+    return parsed.sqsResources.map((queue) => ({
+        name: queue.resourceName,
+        queueType: queue.queueType === "fifo" ? "fifo" : "standard",
+        ...omitUndefined({
+            visibilityTimeout: queue.visibilityTimeout,
+            retentionPeriod: queue.retentionPeriod,
+            contentBasedDeduplication: queue.contentBasedDeduplication,
+            variableName: queue.variableName,
+            extraProperties: queue.extraProperties,
+        }),
+    }));
+}
+/** Resolve a CDN origin identifier back to its resource name */
+function resolveOriginIdentifier(identifier, s3Resources, computeResources) {
+    const s3Match = s3Resources.find((s3) => s3.variableName === identifier);
+    if (s3Match)
+        return s3Match.resourceName;
+    // Compute variable names are camelCase of resource name (e.g., myApi → MyApi)
+    const computeMatch = computeResources.find((c) => c.variableName === identifier ||
+        c.resourceName.charAt(0).toLowerCase() + c.resourceName.slice(1) ===
+            identifier);
+    if (computeMatch)
+        return computeMatch.resourceName;
+    return identifier;
+}
+const CDN_CACHE_POLICIES = ["CACHING_OPTIMIZED", "CACHING_DISABLED"];
+/** Convert parsed CDN resource to plan format */
+function convertCDNResource(parsed) {
+    if (!parsed.cdnResource)
+        return undefined;
+    const cdn = parsed.cdnResource;
+    const config = cdn.config;
+    const resolveOrigin = (val) => {
+        if (isIdentifierRef(val)) {
+            return resolveOriginIdentifier(val.__identifier, parsed.s3Resources, parsed.computeResources);
+        }
+        return asString(val) ?? "";
+    };
+    const defaultOriginRef = resolveOrigin(config.origin);
+    const result = {
+        name: cdn.resourceName,
+        defaultOriginRef,
+    };
+    if (Array.isArray(config.behaviours)) {
+        const behaviours = config.behaviours.filter(isParsedObject).map((b) => ({
+            pathPattern: asString(b.pathPattern) ?? "",
+            originRef: resolveOrigin(b.origin),
+            ...omitUndefined({
+                cachePolicy: asStringUnion(b.cachePolicy, CDN_CACHE_POLICIES),
+            }),
+        }));
+        if (behaviours.length > 0)
+            result.behaviours = behaviours;
+    }
+    // customDomain: direct string property or first element of domainNames array
+    const customDomain = asString(config.customDomain);
+    if (customDomain) {
+        result.customDomain = customDomain;
+    }
+    else {
+        const domainNames = asStringArray(config.domainNames);
+        if (domainNames && domainNames.length > 0) {
+            result.customDomain = domainNames[0];
+        }
+    }
+    const certificateArn = asString(config.certificateArn);
+    if (certificateArn)
+        result.certificateArn = certificateArn;
+    // Extract accessGate — can be false or { type, username, password }
+    if (config.accessGate !== undefined) {
+        if (config.accessGate === false) {
+            result.accessGate = false;
+        }
+        else if (isParsedObject(config.accessGate)) {
+            const gate = config.accessGate;
+            const gateType = asString(gate.type);
+            const username = asString(gate.username);
+            const password = asString(gate.password);
+            if (gateType === "basic-auth" && username && password) {
+                result.accessGate = { type: "basic-auth", username, password };
+            }
+        }
+    }
+    const CDN_KNOWN_KEYS = new Set([
+        "originType",
+        "origin",
+        "behaviours",
+        "customDomain",
+        "domainNames",
+        "certificateArn",
+        "accessGate",
+    ]);
+    const extras = captureExtraProperties(config, CDN_KNOWN_KEYS);
+    if (extras.length > 0)
+        result.extraProperties = extras;
+    return result;
+}
+function convertDatabaseResources(parsed) {
+    return parsed.databaseResources
+        .filter((db) => db.type !== "DynamoDB")
+        .map((database) => ({
+        name: database.resourceName,
+        type: constIncludes(VALID_DB_TYPES, database.type)
+            ? database.type
+            : "Instance",
+        databaseName: database.databaseName,
+        ...omitUndefined({
+            port: database.port,
+            deletionProtection: database.deletionProtection,
+            instanceType: database.instanceType,
+            multiAz: database.multiAz,
+            publiclyAccessible: database.publiclyAccessible,
+            enableSecretRotation: database.enableSecretRotation,
+            encryption: database.encryption,
+            databaseInsights: database.databaseInsights,
+            proxy: database.proxy,
+            readReplica: database.readReplica,
+            credentials: database.credentials,
+            writer: database.writer,
+            readers: database.readers,
+            backupRetention: database.backupRetention,
+            preferredMaintenanceWindow: database.preferredMaintenanceWindow,
+            primaryRegion: database.primaryRegion,
+            secondaryRegions: database.secondaryRegions,
+            globalClusterIdentifier: database.globalClusterIdentifier,
+            enableGlobalWriteForwarding: database.enableGlobalWriteForwarding,
+            variableName: database.variableName,
+            databaseEngine: database.databaseEngine,
+            engineExpression: database.engineExpression,
+            extraProperties: database.extraProperties,
+        }),
+    }));
+}
+function convertS3Resources(parsed) {
+    return parsed.s3Resources.map((s3) => ({
+        name: s3.resourceName,
+        ...(asString(s3.config.bucketName) && {
+            bucketName: asString(s3.config.bucketName),
+        }),
+        ...(asBoolean(s3.config.publicReadAccess) === true && {
+            publicReadAccess: true,
+        }),
+        ...(isParsedObject(s3.config.websiteHosting) &&
+            (() => {
+                const hosting = s3.config.websiteHosting;
+                return {
+                    websiteHosting: {
+                        indexDocument: asString(hosting.indexDocument) ?? "index.html",
+                        ...(asString(hosting.errorDocument) && {
+                            errorDocument: asString(hosting.errorDocument),
+                        }),
+                    },
+                };
+            })()),
+        ...(asStringUnion(s3.config.backupVaultTier, BACKUP_VAULT_TIERS) && {
+            backupVaultTier: asStringUnion(s3.config.backupVaultTier, BACKUP_VAULT_TIERS),
+        }),
+        ...(asBoolean(s3.config.versioned) !== undefined && {
+            versioned: asBoolean(s3.config.versioned),
+        }),
+        ...(asStringUnion(s3.config.encryption, S3_ENCRYPTION_TYPES) && {
+            encryption: asStringUnion(s3.config.encryption, S3_ENCRYPTION_TYPES),
+        }),
+        ...(asString(s3.config.kmsKeyArn) && {
+            kmsKeyArn: asString(s3.config.kmsKeyArn),
+        }),
+        ...(Array.isArray(s3.config.cors) &&
+            s3.config.cors.length > 0 && {
+            cors: s3.config.cors.filter(isParsedObject).map((rule) => ({
+                allowedOrigins: Array.isArray(rule.allowedOrigins)
+                    ? rule.allowedOrigins.filter((o) => typeof o === "string")
+                    : [],
+                allowedMethods: Array.isArray(rule.allowedMethods)
+                    ? rule.allowedMethods.filter((m) => typeof m === "string")
+                    : [],
+            })),
+        }),
+        ...(isParsedObject(s3.config.deployment) &&
+            (() => {
+                const deployment = s3.config.deployment;
+                return {
+                    deployment: {
+                        source: asString(deployment.source) ?? "",
+                        ...(asBoolean(deployment.prune) !== undefined && {
+                            prune: asBoolean(deployment.prune),
+                        }),
+                        ...(isParsedObject(deployment.cacheControl) &&
+                            (() => {
+                                const cache = deployment.cacheControl;
+                                return {
+                                    cacheControl: {
+                                        ...(asNumber(cache.maxAge) !== undefined && {
+                                            maxAge: asNumber(cache.maxAge),
+                                        }),
+                                        ...(asBoolean(cache.immutable) !== undefined && {
+                                            immutable: asBoolean(cache.immutable),
+                                        }),
+                                    },
+                                };
+                            })()),
+                    },
+                };
+            })()),
+        ...(asStringUnion(s3.config.stackPlacement, S3_STACK_PLACEMENTS) && {
+            stackPlacement: asStringUnion(s3.config.stackPlacement, S3_STACK_PLACEMENTS),
+        }),
+        ...(s3.variableName && { variableName: s3.variableName }),
+        ...(() => {
+            const S3_KNOWN_KEYS = new Set([
+                "bucketName",
+                "publicReadAccess",
+                "websiteHosting",
+                "backupVaultTier",
+                "versioned",
+                "encryption",
+                "kmsKeyArn",
+                "cors",
+                "deployment",
+                "stackPlacement",
+            ]);
+            const extras = captureExtraProperties(s3.config, S3_KNOWN_KEYS);
+            return extras.length > 0 ? { extraProperties: extras } : {};
+        })(),
+    }));
+}
+function applyPatternConfig(plan, parsed) {
+    if (!parsed.patternResources || parsed.patternResources.length === 0)
+        return;
+    const patternResource = parsed.patternResources[0];
+    if (patternResource.type !== "payload" && patternResource.type !== "nextjs")
+        return;
+    plan.pattern = patternResource.type;
+    plan.patternConfig = {
+        type: patternResource.type,
+        name: patternResource.config.name,
+        domain: patternResource.config.domain,
+        database: patternResource.config.database,
+        compute: patternResource.config.compute,
+        storage: patternResource.config.storage,
+        messaging: patternResource.config.messaging,
+        cdn: patternResource.config.cdn,
+        environment: patternResource.config.environment,
+    };
+}
+function applyTagsAndOwner(plan, tags) {
+    if (Object.keys(tags).length > 0) {
+        plan.tags = { ...tags };
+    }
+    if (tags[COST_ALLOCATION_TAG]) {
+        plan.owner = tags[COST_ALLOCATION_TAG];
+    }
+}
+function convertAdditionalNetworks(parsed) {
+    if (!parsed.networkResources || parsed.networkResources.length === 0)
+        return undefined;
+    return parsed.networkResources.map((network) => ({
+        name: network.name,
+        ...buildNetworkFields(network.config),
+    }));
+}
+export function convertToResourcePlan(parsed, appName, options) {
+    const plan = {
+        appName,
+        type: "standard",
+        database: [],
+        s3: [],
+        compute: [],
+        importedResources: [],
+    };
+    applyPatternConfig(plan, parsed);
+    if (parsed.vpcId)
+        plan.vpcId = parsed.vpcId;
+    plan.network = convertNetworkConfig(parsed);
+    plan.backup = convertBackupConfig(parsed);
+    plan.tunnel = convertTunnelConfig(parsed);
+    plan.additionalNetworks = convertAdditionalNetworks(parsed);
+    applyTagsAndOwner(plan, parsed.tags);
+    plan.database = convertDatabaseResources(parsed);
+    plan.dynamodb = convertDynamoDBResources(parsed);
+    plan.sqs = convertSQSResources(parsed);
+    plan.cdn = convertCDNResource(parsed);
+    plan.s3 = convertS3Resources(parsed);
+    plan.compute = convertComputeResources(parsed, plan);
+    plan.additionalManagedImports = computeAdditionalManagedImports(parsed.imports);
+    // Round-trip operations (parse → modify → regenerate) skip validation
+    // to tolerate existing apps with non-standard names (e.g. PascalCase).
+    // TODO: Remove once all apps use lowercase-first names (AppNameSchema).
+    if (options?.skipValidation) {
+        return plan;
+    }
+    try {
+        return ApplicationResourcePlanSchema.parse(plan);
+    }
+    catch (error) {
+        if (error instanceof z.ZodError) {
+            const errorMessage = getZodErrorMessage(error);
+            throw new Error(`Invalid infrastructure configuration:\n${errorMessage}`);
+        }
+        throw error;
+    }
+}
+/**
+ * Classify all top-level statements in an infrastructure file.
+ * This identifies which statements are managed by Fjall vs custom user code.
+ */
+export function classifyStatements(sourceFile) {
+    const classifications = [];
+    for (const statement of sourceFile.statements) {
+        const startPos = statement.getFullStart();
+        const endPos = statement.getEnd();
+        if (ts.isImportDeclaration(statement)) {
+            classifications.push({
+                type: "import",
+                node: statement,
+                startPos,
+                endPos,
+                isManaged: isManagedImport(statement),
+            });
+            continue;
+        }
+        // Variable statements (app init, S3 buckets, etc.)
+        if (ts.isVariableStatement(statement)) {
+            const classification = classifyVariableStatement(statement, startPos, endPos);
+            classifications.push(classification);
+            continue;
+        }
+        // Expression statements (app.addDatabase, app.addTags, etc.)
+        if (ts.isExpressionStatement(statement)) {
+            const classification = classifyExpressionStatement(statement, startPos, endPos);
+            classifications.push(classification);
+            continue;
+        }
+        // Any other statement is custom code
+        classifications.push({
+            type: "custom",
+            node: statement,
+            startPos,
+            endPos,
+            isManaged: false,
+        });
+    }
+    return classifications;
+}
+/** Imports that the generator always handles — don't preserve as "additional" */
+const KNOWN_FJALL_IMPORTS = new Set([
+    "App",
+    "Architecture",
+    "DatabaseFactory",
+    "StorageFactory",
+    "ComputeFactory",
+    "getConfig",
+    "MessagingFactory",
+    "CdnFactory",
+    "Code",
+    "Runtime",
+    "FunctionUrlAuthType",
+    "NetworkFactory",
+    "PatternFactory",
+]);
+/** Check if a module specifier belongs to a managed (Fjall/CDK) package */
+function isManagedModuleSpecifier(specifier) {
+    if (specifier.startsWith("@fjall/"))
+        return true;
+    if (specifier === "aws-cdk-lib" || specifier.startsWith("aws-cdk-lib/"))
+        return true;
+    if (specifier === "constructs")
+        return true;
+    return false;
+}
+/**
+ * Compute additional managed imports that the generator doesn't handle.
+ * For @fjall/components-infrastructure: keep named imports NOT in KNOWN_FJALL_IMPORTS.
+ * For other managed modules (aws-cdk-lib/*, constructs): preserve entire import.
+ */
+function computeAdditionalManagedImports(imports) {
+    const additional = [];
+    for (const imp of imports) {
+        if (!isManagedModuleSpecifier(imp.moduleSpecifier))
+            continue;
+        if (imp.moduleSpecifier === "@fjall/components-infrastructure" ||
+            imp.moduleSpecifier === "@fjall/infrastructure") {
+            const extraNames = imp.namedImports.filter((n) => !KNOWN_FJALL_IMPORTS.has(n));
+            if (extraNames.length > 0) {
+                additional.push({
+                    moduleSpecifier: imp.moduleSpecifier,
+                    namedImports: extraNames,
+                    defaultImport: imp.defaultImport,
+                });
+            }
+        }
+        else {
+            // aws-cdk-lib/*, constructs — preserve entire import
+            if (imp.namedImports.length > 0 || imp.defaultImport) {
+                additional.push(imp);
+            }
+        }
+    }
+    return additional.length > 0 ? additional : undefined;
+}
+/**
+ * Check if an import is managed by Fjall.
+ * Managed imports include: @fjall/infrastructure, aws-cdk-lib/*, constructs
+ */
+function isManagedImport(node) {
+    if (!ts.isStringLiteral(node.moduleSpecifier))
+        return false;
+    return isManagedModuleSpecifier(node.moduleSpecifier.text);
+}
+/**
+ * Classify a variable statement (const/let/var declarations).
+ */
+function classifyVariableStatement(statement, startPos, endPos) {
+    for (const declaration of statement.declarationList.declarations) {
+        if (!declaration.initializer)
+            continue;
+        if (isAppGetAppCall(declaration.initializer)) {
+            return {
+                type: "app-init",
+                node: statement,
+                resourceName: ts.isIdentifier(declaration.name)
+                    ? declaration.name.text
+                    : undefined,
+                startPos,
+                endPos,
+                isManaged: true,
+            };
+        }
+        if (ts.isIdentifier(declaration.name) &&
+            declaration.name.text === "appName" &&
+            ts.isStringLiteral(declaration.initializer)) {
+            return {
+                type: "app-init",
+                node: statement,
+                startPos,
+                endPos,
+                isManaged: true,
+            };
+        }
+        if (ts.isNewExpression(declaration.initializer)) {
+            const newExpr = declaration.initializer;
+            if (ts.isIdentifier(newExpr.expression)) {
+                const className = newExpr.expression.text;
+                if (S3_BUCKET_CLASSES.has(className)) {
+                    const resourceName = newExpr.arguments &&
+                        newExpr.arguments.length >= 2 &&
+                        ts.isStringLiteral(newExpr.arguments[1])
+                        ? newExpr.arguments[1].text
+                        : undefined;
+                    return {
+                        type: "storage",
+                        node: statement,
+                        resourceName,
+                        startPos,
+                        endPos,
+                        isManaged: true,
+                    };
+                }
+            }
+        }
+        if (ts.isCallExpression(declaration.initializer)) {
+            const classification = classifyCallExpression(declaration.initializer, statement, startPos, endPos);
+            if (classification.type !== "custom") {
+                return classification;
+            }
+        }
+    }
+    return {
+        type: "custom",
+        node: statement,
+        startPos,
+        endPos,
+        isManaged: false,
+    };
+}
+/**
+ * Classify an expression statement (method calls like app.addDatabase).
+ */
+function classifyExpressionStatement(statement, startPos, endPos) {
+    const expr = statement.expression;
+    if (ts.isCallExpression(expr)) {
+        return classifyCallExpression(expr, statement, startPos, endPos);
+    }
+    return {
+        type: "custom",
+        node: statement,
+        startPos,
+        endPos,
+        isManaged: false,
+    };
+}
+/**
+ * Classify a call expression (e.g., app.addDatabase, app.addTags).
+ */
+function classifyCallExpression(call, statement, startPos, endPos) {
+    const expression = call.expression;
+    if (ts.isPropertyAccessExpression(expression) &&
+        ts.isIdentifier(expression.expression)) {
+        const methodName = expression.name.text;
+        if (methodName === "addTags") {
+            return {
+                type: "tags",
+                node: statement,
+                startPos,
+                endPos,
+                isManaged: true,
+            };
+        }
+        const factoryMethods = {
+            addDatabase: { type: "database", factory: "DatabaseFactory" },
+            addCompute: { type: "compute", factory: "ComputeFactory" },
+            addNetwork: { type: "network", factory: "NetworkFactory" },
+            addMessaging: { type: "messaging", factory: "MessagingFactory" },
+            addCdn: { type: "cdn", factory: "CdnFactory" },
+            addPattern: { type: "pattern", factory: "PatternFactory" },
+            addStorage: { type: "storage", factory: "StorageFactory" },
+        };
+        const factoryMethod = factoryMethods[methodName];
+        if (factoryMethod) {
+            const resourceName = extractResourceNameFromFactoryCall(call, factoryMethod.factory);
+            return {
+                type: factoryMethod.type,
+                node: statement,
+                resourceName,
+                startPos,
+                endPos,
+                isManaged: true,
+            };
+        }
+    }
+    return {
+        type: "custom",
+        node: statement,
+        startPos,
+        endPos,
+        isManaged: false,
+    };
+}
+/**
+ * Extract the resource name from a Factory.build() call.
+ * e.g., app.addDatabase(DatabaseFactory.build("MyDatabase", {...}))
+ */
+function extractResourceNameFromFactoryCall(addCall, factoryName) {
+    if (addCall.arguments.length === 0)
+        return undefined;
+    const factoryArg = addCall.arguments[0];
+    if (!ts.isCallExpression(factoryArg))
+        return undefined;
+    const factoryExpr = factoryArg.expression;
+    if (!ts.isPropertyAccessExpression(factoryExpr) ||
+        factoryExpr.name.text !== "build" ||
+        !ts.isIdentifier(factoryExpr.expression) ||
+        factoryExpr.expression.text !== factoryName) {
+        return undefined;
+    }
+    if (factoryArg.arguments.length === 0)
+        return undefined;
+    const nameArg = factoryArg.arguments[0];
+    if (ts.isStringLiteral(nameArg)) {
+        return nameArg.text;
+    }
+    return undefined;
+}
+const POSITION_BY_MANAGED_TYPE = {
+    import: "after-imports",
+    "app-init": "after-app-init",
+    tags: "after-tags",
+};
+function determineCustomBlockPosition(lastManaged) {
+    if (!lastManaged)
+        return { position: "before-imports" };
+    const knownPosition = POSITION_BY_MANAGED_TYPE[lastManaged.type];
+    if (knownPosition)
+        return { position: knownPosition };
+    return {
+        position: "after-resource",
+        afterManagedResource: {
+            type: lastManaged.type,
+            name: lastManaged.resourceName,
+        },
+    };
+}
+/**
+ * Extract custom code blocks from an infrastructure file.
+ * Returns an array of custom code blocks with their positions relative to managed resources.
+ */
+export function extractCustomCodeBlocks(sourceFile, precomputedClassifications) {
+    const classifications = precomputedClassifications ?? classifyStatements(sourceFile);
+    const customBlocks = [];
+    const sourceText = sourceFile.getFullText();
+    let lastManagedStatement = null;
+    for (const current of classifications) {
+        if (current.type === "custom" && !current.isManaged) {
+            const { position, afterManagedResource } = determineCustomBlockPosition(lastManagedStatement);
+            const fullText = getStatementTextWithComments(sourceFile, sourceText, current.node);
+            const leadingComments = extractLeadingComments(sourceFile, sourceText, current.node);
+            const lineAndChar = sourceFile.getLineAndCharacterOfPosition(current.node.getStart());
+            customBlocks.push({
+                sourceText: fullText,
+                position,
+                afterManagedResource,
+                originalLine: lineAndChar.line + 1,
+                leadingComments: leadingComments.length > 0 ? leadingComments : undefined,
+            });
+        }
+        else if (current.isManaged) {
+            lastManagedStatement = current;
+        }
+    }
+    return customBlocks;
+}
+/**
+ * Get the full statement text including any leading comments and whitespace.
+ */
+function getStatementTextWithComments(sourceFile, sourceText, node) {
+    const fullStart = node.getFullStart();
+    const end = node.getEnd();
+    const text = sourceText.slice(fullStart, end);
+    const lines = text.split("\n");
+    const startIndex = lines.findIndex((line) => line.trim() !== "");
+    return lines.slice(startIndex === -1 ? 0 : startIndex).join("\n");
+}
+/**
+ * Extract leading comments for a node.
+ */
+function extractLeadingComments(sourceFile, sourceText, node) {
+    const comments = [];
+    const commentRanges = ts.getLeadingCommentRanges(sourceText, node.getFullStart());
+    if (commentRanges) {
+        for (const range of commentRanges) {
+            const commentText = sourceText.slice(range.pos, range.end);
+            comments.push(commentText);
+        }
+    }
+    return comments;
+}
+/**
+ * Find the position information for a specific managed resource.
+ * Useful for surgical updates.
+ */
+export function findManagedResourcePosition(sourceFile, resourceType, resourceName, precomputedClassifications) {
+    const classifications = precomputedClassifications ?? classifyStatements(sourceFile);
+    for (const classification of classifications) {
+        if (classification.type === resourceType &&
+            classification.resourceName === resourceName) {
+            return {
+                startPos: classification.startPos,
+                endPos: classification.endPos,
+                node: classification.node,
+            };
+        }
+    }
+    return null;
+}
+/**
+ * Get the last managed statement of a specific type.
+ * Used to determine insertion points for new resources.
+ */
+export function getLastManagedStatementOfType(sourceFile, type, precomputedClassifications) {
+    const classifications = precomputedClassifications ?? classifyStatements(sourceFile);
+    let lastOfType = null;
+    for (const classification of classifications) {
+        if (classification.type === type && classification.isManaged) {
+            lastOfType = classification;
+        }
+    }
+    return lastOfType;
+}
+/**
+ * Get all managed resources grouped by type.
+ * Useful for understanding the structure of an infrastructure file.
+ */
+export function getManagedResourcesByType(sourceFile, precomputedClassifications) {
+    const classifications = precomputedClassifications ?? classifyStatements(sourceFile);
+    const byType = {
+        import: [],
+        "app-init": [],
+        tags: [],
+        database: [],
+        compute: [],
+        storage: [],
+        network: [],
+        messaging: [],
+        cdn: [],
+        pattern: [],
+        custom: [],
+    };
+    for (const classification of classifications) {
+        byType[classification.type].push(classification);
+    }
+    return byType;
+}