@fjall/generator 12.2.0 → 12.4.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "1d86f2721574bd7a32427e68cc5cc46b922391f918ed94d31bbd020a8793684a",
+  "hash": "48518b3a5c7046e1f70220963f3e8092d0aef895768ccda618686a39da5e3521",
   "files": {
     "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
     "src/ast/domain/astDomainParser.ts": "940ce5742507477d",
@@ -110,9 +110,10 @@
     "src/detection/index.ts": "b4ad9a935564cb3e",
     "src/dns/bindParser.ts": "376d274bf9e4bf9f",
     "src/dns/bindWriter.ts": "c296911ce5aef77c",
-    "src/dns/domainFileGenerator.ts": "29ece83900ecc829",
+    "src/dns/domainFileGenerator.ts": "179258ce9d15d990",
     "src/dns/domainRecords.ts": "ab917006b92ae916",
-    "src/dns/index.ts": "b476ef3d7b381dc8",
+    "src/dns/index.ts": "266288ae3b851e3d",
+    "src/dns/tsEmitter.ts": "2f2f13061d1850db",
     "src/dns/types.ts": "82d6db9d7d26dbc2",
     "src/generation/common.ts": "ab66eac580bc227f",
     "src/generation/compute.ts": "4029a0d8e3197686",
@@ -170,11 +171,11 @@
     "src/validation/patterns.ts": "f9629eafdad7ac3e",
     "src/validation/validationMessages.ts": "c727ade4690274f4",
     "src/validation/validationPatterns.ts": "865f3d688975b7c8",
-    "src/version.ts": "db9733ad49a0a09f",
+    "src/version.ts": "590606bf601e4cb0",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "6cfc3e528cdef1f8",
+    "package.json": "21be102c0a66d891",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "24e38729c09132203b54654d521ace20cbfe8b657ff30d750df00c4ed260cfa6",
-  "outputFileCount": 321
+  "outputHash": "7073a96eafc77699be665932751120127fd3941e8cdd876b3d4f627616015201",
+  "outputFileCount": 323
 }

package/dist/.minified

@@ -1 +1 @@
-160 files minified at 2026-08-15T22:07:36.769Z
+161 files minified at 2026-08-16T02:09:56.608Z

package/dist/src/dns/domainFileGenerator.d.ts

@@ -1,6 +1,6 @@
 import type { DnsRecord } from "./types.js";
 export interface GeneratedFile {
-    /** Path relative to the repo root (e.g. "fjall/domains/example.com/zone.bind") */
+    /** Path relative to the repo root (e.g. "fjall/domains/example.com/infrastructure.ts") */
     readonly path: string;
     /** File content as a string */
     readonly content: string;
@@ -12,6 +12,13 @@ export interface DomainGenerationOptions {
     readonly hostedZoneId?: string;
     /** Pre-populated DNS records (e.g. from Route53 import) */
     readonly records?: DnsRecord[];
+    /**
+     * Directory the domain component is generated into, relative to the repo
+     * root — `<boundaryDir>/domains/<domainName>` when the fjall boundary
+     * lives inside a container directory. Defaults to the bare-boundary
+     * spelling `fjall/domains/<domainName>`.
+     */
+    readonly basePath?: string;
 }
 /**
  * Generates all files for a domain component as pure strings.

package/dist/src/dns/domainFileGenerator.js

@@ -1,7 +1,7 @@
-var p=Object.defineProperty;var r=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as w}from"@fjall/util";import{toPascalCase as f}from"../generation/common.js";import{GENERATOR_VERSION as u}from"../version.js";function j(t){const{domainName:e,hostedZoneId:o,records:n=[]}=t,a=`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:k({domainName:e,records:n,hostedZoneId:o})},{path:`${a}/package.json`,content:g(e)},{path:`${a}/tsconfig.json`,content:S},{path:`${a}/cdk.json`,content:N},{path:`${a}/.gitignore`,content:y}]}r(j,"generateDomainFiles");function k(t){const{domainName:e,records:o,hostedZoneId:n}=t,a=f(e.split(".").join("")),c=w(e),i=o.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),d=i.length>0?`[
-${i.join(`
+var p=Object.defineProperty;var o=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as g}from"@fjall/util";import{toPascalCase as w}from"../generation/common.js";import{GENERATOR_VERSION as d}from"../version.js";function I(t){const{domainName:e,hostedZoneId:r,records:n=[]}=t,a=t.basePath??`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:h({domainName:e,records:n,hostedZoneId:r})},{path:`${a}/package.json`,content:f(e)},{path:`${a}/tsconfig.json`,content:y},{path:`${a}/cdk.json`,content:N},{path:`${a}/cdk.context.json`,content:S},{path:`${a}/.gitignore`,content:k}]}o(I,"generateDomainFiles");function h(t){const{domainName:e,records:r,hostedZoneId:n}=t,a=w(e.split(".").join("")),i=g(e),c=r.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),l=c.length>0?`[
+${c.join(`
 `)}
-  ]`:"[]",l=n?`  hostedZoneId: ${JSON.stringify(n)},
+  ]`:"[]",u=n?`  hostedZoneId: ${JSON.stringify(n)},
 `:"";return`import {
   App,
   Domain,
@@ -10,29 +10,164 @@ ${i.join(`
 // Fjall-managed domain \u2014 edit this file to add or change records.
 // See https://docs.fjall.io/resources/networking/domain for the Domain construct API.
 
-const app = App.getApp(${JSON.stringify(c)});
-
-// Stack name must equal getDomainStackName(${JSON.stringify(e)}) \u2014 the CLI's
-// deploy record and ManagedDomainBinding resolution both DescribeStacks by it.
-const stack = app.getStack(${JSON.stringify(c)}).getStack();
+const app = App.getApp(${JSON.stringify(i)});
+// The stack name is Fjall's domain deploy contract (getDomainStackName) \u2014
+// the CLI records and resolves the deployed domain by this exact
+// CloudFormation stack name. Do not rename it.
+const stack = app.getStack(${JSON.stringify(i)}).getStack();
 
 new Domain(stack, ${JSON.stringify(a)}, {
   registrar: "route53",
   zoneName: ${JSON.stringify(e)},
-${l}  certificates: [
+${u}  certificates: [
     { domainName: ${JSON.stringify(e)} },
+    // Serving this zone through CloudFront (staticsite/cdn)? Add a viewer
+    // certificate with cloudFront: true \u2014 it is minted in us-east-1 (the
+    // only region CloudFront accepts) and publishes the zone-level
+    // us-east-1 certificate export the deploy binding carries, e.g.:
+    //   { domainName: "www.${e}", cloudFront: true },
   ],
-  records: ${d},
+  records: ${l},
 });
-`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.265.0",constructs:"^10.7.2"}},null,2)+`
-`}r(g,"generateDomainPackageJson");const y=`node_modules/
-cdk.out/
+
+// Delegating a subdomain to another account? (D8 \u2014 child writes NS.)
+// Declare the child as its own Domain with registrar: "external-delegated"
+// and delegatedSubdomain set; the Fjall CLI injects parentDelegationRoleArn
+// (ManagedDomainBinding.delegationRoleArn) so the child UPSERTs its NS
+// records into this zone. This apex declares no delegations[].
+// Adopting an EXISTING child zone instead of creating one? Set hostedZoneId
+// and adoptedNameServers (both together) on the child Domain \u2014 the literals
+// feed the parent NS UPSERT because an imported zone exposes no name-server
+// attribute at synth.
+`}o(h,"generateDefaultInfrastructureTs");function f(t){return`{
+  "name": ${JSON.stringify(`domain-${t}`)},
+  "version": "${d}",
+  "type": "module",
+  "scripts": {},
+  "devDependencies": {
+    "@types/node": "25.6.0",
+    "tsx": "^4.21.0",
+    "typescript": "~6.0.3"
+  },
+  "dependencies": {
+    "@fjall/components-infrastructure": "^${d}",
+    "aws-cdk-lib": "^2.265.0",
+    "constructs": "^10.7.2"
+  }
+}
+`}o(f,"generateDomainPackageJson");const k=`*.js
 *.d.ts
-*.js
+node_modules
+.cdk.staging
+**/**/cdk.out
+
+.DS_Store
+
+# Fjall config (contains organisation-specific settings)
+fjall-config.json
+
+# Fjall-managed state directories. Keep explicit so drift baselines
+# (Phase 6) and codemod history (Phase 2) stay out of version control.
+/.fjall/history/
+/.fjall/baseline/
+/.fjall/logs/
+
+# Fjall per-target deploy state \u2014 a per-machine cache of last-deployed template
+# hashes (cascade deploys write one file per account/region). Safe when absent:
+# a missing file marks every stack changed, so the next deploy is a full deploy.
+# Stays out of version control to avoid churn and merge conflicts between
+# deployers. The *.tmp pair covers atomic-write temp files; the
+# .deploy-state.json pair is the legacy name, kept while migration unlinks it.
 .fjall-state*.json
 .fjall-state*.json.tmp
 .deploy-state.json
 .deploy-state.json.tmp
-`,S=JSON.stringify({compilerOptions:{target:"ES2020",module:"commonjs",lib:["es2020","dom"],declaration:!0,strict:!0,noImplicitAny:!0,strictNullChecks:!0,noImplicitThis:!0,alwaysStrict:!0,noUnusedLocals:!1,noUnusedParameters:!1,noImplicitReturns:!0,noFallthroughCasesInSwitch:!1,inlineSourceMap:!0,inlineSources:!0,experimentalDecorators:!0,strictPropertyInitialization:!1,typeRoots:["./node_modules/@types"]},exclude:["node_modules","cdk.out"]},null,2)+`
-`,N=JSON.stringify({app:"npx ts-node --prefer-ts-exts --transpile-only infrastructure.ts",assetMetadata:!1,pathMetadata:!1,versionReporting:!1,watch:{include:["**"],exclude:["README.md","cdk*.json","**/*.d.ts","**/*.js","tsconfig.json","package*.json","yarn.lock","node_modules","test"]},context:{"@aws-cdk/aws-lambda:recognizeLayerVersion":!0,"@aws-cdk/core:checkSecretUsage":!0,"@aws-cdk/core:target-partitions":["aws","aws-cn"],"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver":!0,"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName":!0,"@aws-cdk/aws-ecs:arnFormatIncludesClusterName":!0,"@aws-cdk/aws-iam:minimizePolicies":!0,"@aws-cdk/core:validateSnapshotRemovalPolicy":!0,"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName":!0,"@aws-cdk/aws-s3:createDefaultLoggingPolicy":!0,"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":!0,"@aws-cdk/aws-apigateway:disableCloudWatchRole":!0,"@aws-cdk/core:enablePartitionLiterals":!0,"@aws-cdk/aws-events:eventsTargetQueueSameAccount":!0,"@aws-cdk/aws-iam:standardizedServicePrincipals":!0,"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":!0,"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName":!0,"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":!0,"@aws-cdk/aws-route53-patters:useCertificate":!0,"@aws-cdk/customresources:installLatestAwsSdkDefault":!1,"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":!0,"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup":!0,"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId":!0,"@aws-cdk/aws-ec2:launchTemplateDefaultUserData":!0,"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments":!0,"@aws-cdk/aws-redshift:columnId":!0,"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":!0,"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup":!0,"@aws-cdk/aws-apigateway:requestValidatorUniqueId":!0,"@aws-cdk/aws-kms:aliasNameRef":!0,"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig":!0,"@aws-cdk/core:includePrefixInUniqueNameGeneration":!0,"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby":!0}},null,2)+`
-`;export{j as generateDomainFiles};
+
+# Fjall backup files (sibling \`.bak\` from codemod mutations + domain eject)
+**/backup/
+*.bak
+`,y=`{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["es2022"],
+    "declaration": true,
+    "strict": true,
+    "noImplicitAny": true,
+    "strictNullChecks": true,
+    "noImplicitThis": true,
+    "alwaysStrict": true,
+    "noUnusedLocals": false,
+    "noUnusedParameters": false,
+    "noImplicitReturns": true,
+    "noFallthroughCasesInSwitch": false,
+    "inlineSourceMap": true,
+    "inlineSources": true,
+    "experimentalDecorators": true,
+    "strictPropertyInitialization": false,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "exclude": ["node_modules", "cdk.out"]
+}
+`,S=`{
+  "acknowledged-issue-numbers": [32775, 34892, 34635]
+}
+`,N=`{
+  "app": "npx tsx infrastructure.ts",
+  "assetMetadata": false,
+  "pathMetadata": false,
+  "versionReporting": false,
+  "watch": {
+    "include": ["**"],
+    "exclude": [
+      "README.md",
+      "cdk*.json",
+      "**/*.d.ts",
+      "**/*.js",
+      "tsconfig.json",
+      "package*.json",
+      "yarn.lock",
+      "node_modules",
+      "test"
+    ]
+  },
+  "context": {
+    "@aws-cdk/aws-lambda:recognizeLayerVersion": true,
+    "@aws-cdk/core:checkSecretUsage": true,
+    "@aws-cdk/core:target-partitions": ["aws", "aws-cn"],
+    "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
+    "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
+    "@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
+    "@aws-cdk/aws-iam:minimizePolicies": true,
+    "@aws-cdk/core:validateSnapshotRemovalPolicy": true,
+    "@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
+    "@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
+    "@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
+    "@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
+    "@aws-cdk/core:enablePartitionLiterals": true,
+    "@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
+    "@aws-cdk/aws-iam:standardizedServicePrincipals": true,
+    "@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
+    "@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
+    "@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
+    "@aws-cdk/aws-route53-patters:useCertificate": true,
+    "@aws-cdk/customresources:installLatestAwsSdkDefault": false,
+    "@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
+    "@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
+    "@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
+    "@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
+    "@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
+    "@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
+    "@aws-cdk/aws-redshift:columnId": true,
+    "@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2": true,
+    "@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
+    "@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
+    "@aws-cdk/aws-kms:aliasNameRef": true,
+    "@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
+    "@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
+    "@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby": true
+  }
+}
+`;export{I as generateDomainFiles};

package/dist/src/dns/index.d.ts

@@ -3,3 +3,4 @@ export * from "./domainRecords.js";
 export { parseZoneFile, resolveAlias } from "./bindParser.js";
 export { generateZoneFile } from "./bindWriter.js";
 export { type GeneratedFile, type DomainGenerationOptions, generateDomainFiles, } from "./domainFileGenerator.js";
+export { type EmitDomainTsOptions, emitDomainTs, emitRecordObjectText, } from "./tsEmitter.js";

package/dist/src/dns/index.js

@@ -1 +1 @@
-export*from"./types.js";export*from"./domainRecords.js";import{parseZoneFile as m,resolveAlias as p}from"./bindParser.js";import{generateZoneFile as f}from"./bindWriter.js";import{generateDomainFiles as l}from"./domainFileGenerator.js";export{l as generateDomainFiles,f as generateZoneFile,m as parseZoneFile,p as resolveAlias};
+export*from"./types.js";export*from"./domainRecords.js";import{parseZoneFile as m,resolveAlias as i}from"./bindParser.js";import{generateZoneFile as x}from"./bindWriter.js";import{generateDomainFiles as f}from"./domainFileGenerator.js";import{emitDomainTs as l,emitRecordObjectText as s}from"./tsEmitter.js";export{l as emitDomainTs,s as emitRecordObjectText,f as generateDomainFiles,x as generateZoneFile,m as parseZoneFile,i as resolveAlias};

package/dist/src/dns/tsEmitter.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Typed-construct emitter for domain `infrastructure.ts` files — the SSOT
+ * both the CLI import/create flows and the webapp record engine render
+ * through (domains completion programme, train B0). Pure string-in/string-out:
+ * no I/O, no CLI coupling.
+ */
+import type { ParsedDomainRecords, ParsedDnsRecord } from "./domainRecords.js";
+/**
+ * Bare record object literal — no file indent, no trailing comma. Published
+ * so the webapp's record-splice edit engine renders spliced records through
+ * the same emitter as generated files (train B) instead of restating the
+ * byte shape; `emitRecord` wraps it with the records-array indentation.
+ */
+export declare function emitRecordObjectText(r: ParsedDnsRecord): string;
+export interface EmitDomainTsOptions {
+    /**
+     * Domain component name the emitted file is ADDRESSED by (D2 contract:
+     * the App/getStack literals must equal `getDomainStackName(componentName)`
+     * because deploy state and binding resolution derive the stack name from
+     * the component directory name). The delegated scaffold needs this: its
+     * component is named by the CHILD fqdn while `parsed.zoneName` is the
+     * PARENT zone. Default preserves the import flow's identity
+     * (componentName === parsed.zoneName).
+     */
+    readonly componentName?: string;
+}
+export declare function emitDomainTs(parsed: ParsedDomainRecords, emitOptions?: EmitDomainTsOptions): string;

package/dist/src/dns/tsEmitter.js

@@ -0,0 +1,46 @@
+var A=Object.defineProperty;var o=(e,n)=>A(e,"name",{value:n,configurable:!0});import{getDomainStackName as k,toPascalCase as D}from"@fjall/util";const O=["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"],b=new Map(O.map((e,n)=>[e,n]));function C(e,n){return e==="@"&&n!=="@"?-1:e!=="@"&&n==="@"?1:e.localeCompare(n)}o(C,"compareName");function J(e,n){const t=Array.isArray(e)?e.join(`
+`):e,a=Array.isArray(n)?n.join(`
+`):n;return t.localeCompare(a)}o(J,"compareValue");function p(e){const n=e.kind==="standard"?0:1,t=b.get(e.type)??99;return[n,t,e.name]}o(p,"recordSortKey");function R(e){return[...e].sort((n,t)=>{const[a,c,m]=p(n),[s,d,f]=p(t);if(a!==s)return a-s;if(c!==d)return c-d;const u=C(m,f);return u!==0?u:n.kind==="standard"&&t.kind==="standard"?J(n.value,t.value):0})}o(R,"sortRecords");function P(e){return Array.isArray(e)?`[${e.map(t=>JSON.stringify(t)).join(", ")}]`:JSON.stringify(e)}o(P,"formatValue");function v(e){const n=[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`,`value: ${P(e.value)}`];return e.ttl!==void 0&&n.push(`ttl: ${e.ttl}`),`{ ${n.join(", ")} }`}o(v,"emitStandardRecord");function I(e){switch(e.kind){case"ecs":return e.computeName===void 0?`fjallApp(${JSON.stringify(e.appName)})`:`fjallApp(${JSON.stringify(e.appName)}, ${JSON.stringify(e.computeName)})`;case"cdn":return`fjallCdn(${JSON.stringify(e.appName)})`;case"bucket":return`fjallBucket(${JSON.stringify(e.bucketName)})`;case"custom":return`aliasTo(${JSON.stringify(e.dnsName)}, ${JSON.stringify(e.hostedZoneId)})`}}o(I,"emitAliasTarget");function x(e){return`{ ${[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`,`target: ${I(e.target)}`].join(", ")} }`}o(x,"emitAliasRecord");function T(e){return e.kind==="standard"?v(e):x(e)}o(T,"emitRecordObjectText");function w(e){return`    ${T(e)},`}o(w,"emitRecord");function z(e){const n=[`domainName: ${JSON.stringify(e.domainName)}`];if(e.subjectAlternativeNames&&e.subjectAlternativeNames.length>0){const t=e.subjectAlternativeNames.map(a=>JSON.stringify(a)).join(", ");n.push(`subjectAlternativeNames: [${t}]`)}return e.transparencyLogging!==void 0&&n.push(`transparencyLogging: ${e.transparencyLogging}`),e.cloudFront!==void 0&&n.push(`cloudFront: ${e.cloudFront}`),`    { ${n.join(", ")} },`}o(z,"emitCertificate");function B(e,n){if(n.length===0)return"";const t=["","// Delegations (D8 \u2014 child writes NS; no parent-side records here):"];for(const a of n)t.push(`//   ${a.subdomain}.${e} \u2192 deploy a Domain { registrar: "external-delegated",`,`//     zoneName: ${JSON.stringify(e)}, delegatedSubdomain: ${JSON.stringify(a.subdomain)} }`,`//     in account ${JSON.stringify(a.toAccount)}; the CLI injects parentDelegationRoleArn`,"//     (ManagedDomainBinding.delegationRoleArn) and the child UPSERTs its NS into this zone.");return t.join(`
+`)+`
+`}o(B,"emitDelegationGuidance");function F(e){const n={fjallApp:!1,fjallCdn:!1,fjallBucket:!1,aliasTo:!1};for(const t of e)if(t.kind==="alias")switch(t.target.kind){case"ecs":n.fjallApp=!0;break;case"cdn":n.fjallCdn=!0;break;case"bucket":n.fjallBucket=!0;break;case"custom":n.aliasTo=!0;break}return n}o(F,"computeUsedHelpers");function L(e){const n=["App","Domain"];return e.aliasTo&&n.push("aliasTo"),e.fjallApp&&n.push("fjallApp"),e.fjallBucket&&n.push("fjallBucket"),e.fjallCdn&&n.push("fjallCdn"),`import {
+${n.map(a=>`  ${a},`).join(`
+`)}
+} from "@fjall/components-infrastructure";`}o(L,"emitImports");function E(e){return D(e.split(".").join(""))}o(E,"safeZoneName");function g(e,n){if(e==="@")return e;const t=e.endsWith(".")?e.slice(0,-1):e;return t===n?"@":t.endsWith(`.${n}`)?t.slice(0,-(n.length+1)):e}o(g,"toRelativeRecordName");function Z(e){return e.registrar==="external-delegated"&&e.delegatedSubdomain?`${e.delegatedSubdomain}.${e.zoneName}`:e.zoneName}o(Z,"effectiveZoneName");function y(e,n,t){if(n.length===0)return`  ${e}: [],`;const a=n.map(t).join(`
+`);return`  ${e}: [
+${a}
+  ],`}o(y,"emitBlock");function K(e,n={}){const t=k(n.componentName??e.zoneName),a=E(e.zoneName),c=F(e.records),m=L(c),s=Z(e),d=e.records.map(i=>i.kind==="standard"?{...i,name:g(i.name,s)}:{...i,name:g(i.name,s)}),f=R(d),u=[...e.certificates].sort((i,l)=>i.domainName.localeCompare(l.domainName)),h=[...e.delegations].sort((i,l)=>i.subdomain.localeCompare(l.subdomain)),r=[];if(e.hostedZoneId&&r.push(`  hostedZoneId: ${JSON.stringify(e.hostedZoneId)},`),e.adoptedNameServers&&e.adoptedNameServers.length>0){const i=e.adoptedNameServers.map(l=>JSON.stringify(l)).join(", ");r.push(`  adoptedNameServers: [${i}],`)}e.delegatedSubdomain&&r.push(`  delegatedSubdomain: ${JSON.stringify(e.delegatedSubdomain)},`),e.registrar==="external-delegated"&&r.push("  // D8 child-writes delegation + two-phase deploy: both values arrive","  // via CDK context, injected by the Fjall CLI at deploy time (see the","  // reads above `new Domain`). Set a literal parentDelegationRoleArn","  // here only for out-of-band deploys.",'  ...(domainDeployPhase === "zone" || domainDeployPhase === "full"',"    ? { phase: domainDeployPhase }","    : {}),",'  ...(typeof parentDelegationRoleArn === "string" &&','  parentDelegationRoleArn !== ""',"    ? { parentDelegationRoleArn }","    : {}),");const N=y("certificates",u,z),S=y("records",f,w),$=e.registrar==="external-records"?"":B(e.zoneName,h),j=e.registrar==="external-delegated"?`
+// Injected by the Fjall CLI at deploy time (D8) \u2014 do not set these by hand.
+const domainDeployPhase: unknown = app.node.tryGetContext(
+  "fjall:domainDeployPhase"
+);
+if (
+  domainDeployPhase !== undefined &&
+  domainDeployPhase !== "zone" &&
+  domainDeployPhase !== "full"
+) {
+  throw new Error(
+    \`Domain deploy: CDK context 'fjall:domainDeployPhase' must be "zone" or "full" (got \${JSON.stringify(domainDeployPhase)}) \u2014 re-run the deploy through the Fjall CLI, or correct the hand-set context entry.\`
+  );
+}
+const parentDelegationRoleArn: unknown = app.node.tryGetContext(
+  "fjall:parentDelegationRoleArn"
+);
+`:"";return`${m}
+
+// Fjall-managed domain \u2014 edit this file to add or change records. See https://docs.fjall.io/resources/networking/domain for the Domain construct API.
+
+const app = App.getApp(${JSON.stringify(t)});
+// The stack name is Fjall's domain deploy contract (getDomainStackName) \u2014
+// the CLI records and resolves the deployed domain by this exact
+// CloudFormation stack name. Do not rename it.
+const stack = app.getStack(${JSON.stringify(t)}).getStack();
+${j}
+new Domain(stack, ${JSON.stringify(a)}, {
+  registrar: ${JSON.stringify(e.registrar)},
+  zoneName: ${JSON.stringify(e.zoneName)},
+${r.length>0?r.join(`
+`)+`
+`:""}${N}
+${S}
+});
+${$}`}o(K,"emitDomainTs");export{K as emitDomainTs,T as emitRecordObjectText};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "12.2.0";
+export declare const GENERATOR_VERSION = "12.4.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="12.2.0";export{E as GENERATOR_VERSION};
+const E="12.4.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "12.2.0",
+  "version": "12.4.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -23,6 +23,10 @@
       "types": "./dist/src/detection/index.d.ts",
       "default": "./dist/src/detection/index.js"
     },
+    "./dns": {
+      "types": "./dist/src/dns/index.d.ts",
+      "default": "./dist/src/dns/index.js"
+    },
     "./schemas": {
       "types": "./dist/src/schemas/index.d.ts",
       "default": "./dist/src/schemas/index.js"
@@ -53,7 +57,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^12.2.0",
+    "@fjall/util": "^12.4.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",