@fjall/generator 14.1.0 → 14.2.0

package/dist/src/projection/index.d.ts

@@ -1,3 +1,4 @@
-export { projectPlanToConstructProps } from "./project.js";
+export { constructKeyAliasesFor, crossKeyUnprojectables, projectPlanToConstructProps, } from "./project.js";
+export { UNRESOLVED } from "./unresolved.js";
 export { isProjectableType, TYPE_PROJECTIONS, type ProjectableType, } from "./tables.js";
-export type { PlanKeyRule, Projection, ProjectionContext, ProjectedProp, ProjectedValue, TypeProjection, UnprojectableKind, UnprojectableProp, } from "./types.js";
+export type { CrossKeyRule, ExpansionDerivation, FragmentExpansion, PlanKeyRule, Projection, ProjectionContext, ProjectedProp, ProjectedValue, SiblingDerivation, SiblingProjection, SiblingStatement, StructuredBinding, StructuredCallArgument, StructuredExpression, StructuredObjectEntry, StructuredValue, TypeProjection, UnprojectableKind, UnprojectableProp, } from "./types.js";

package/dist/src/projection/index.js

@@ -1 +1 @@
-import{projectPlanToConstructProps as e}from"./project.js";import{isProjectableType as p,TYPE_PROJECTIONS as P}from"./tables.js";export{P as TYPE_PROJECTIONS,p as isProjectableType,e as projectPlanToConstructProps};
+import{constructKeyAliasesFor as e,crossKeyUnprojectables as t,projectPlanToConstructProps as s}from"./project.js";import{UNRESOLVED as p}from"./unresolved.js";import{isProjectableType as a,TYPE_PROJECTIONS as l}from"./tables.js";export{l as TYPE_PROJECTIONS,p as UNRESOLVED,e as constructKeyAliasesFor,t as crossKeyUnprojectables,a as isProjectableType,s as projectPlanToConstructProps};

package/dist/src/projection/project.d.ts

@@ -1,5 +1,20 @@
 import { type ProjectableType } from "./tables.js";
-import type { Projection, ProjectionContext } from "./types.js";
+import type { Projection, ProjectionContext, UnprojectableProp } from "./types.js";
+/**
+ * The type's construct-key alias map, `{}` when the type declares none or is
+ * not projected at all. The modify path consults this to land an edit ON an
+ * alias-spelt existing property rather than appending the canonical key
+ * beside it — see {@link TypeProjection.constructKeyAliases}.
+ */
+export declare function constructKeyAliasesFor(type: string): Readonly<Record<string, ReadonlyArray<string>>>;
+/**
+ * Every `crossKey` rule of `type` that fires over `fragment`, as
+ * property-attributed unprojectable entries. Exposed separately from the
+ * projection because the modify judge must run these over its merged
+ * whole-statement views — the engine below skips them on `editingExisting`,
+ * where a bare edit fragment would fire "key absent" conditions falsely.
+ */
+export declare function crossKeyUnprojectables(type: ProjectableType, fragment: Readonly<Record<string, unknown>>): UnprojectableProp[];
 /**
  * Project a resource-plan fragment onto its construct's props.
  *

package/dist/src/projection/project.js

@@ -1 +1 @@
-var k=Object.defineProperty;var f=(r,u)=>k(r,"name",{value:u,configurable:!0});import{TYPE_PROJECTIONS as y}from"./tables.js";function b(r,u,a={}){const o=y[r],i=[];let p=[];if(a.editingExisting!==!0)if(typeof o.constants=="function"){const n=o.constants(a);p=n.props,i.push(...n.unprojectable.map(s=>({...s,kind:s.kind??"missing-context"})))}else p=o.constants??[];const c=new Map(p.map(n=>[n.key,n]));for(const[n,s]of Object.entries(u)){if(s===void 0)continue;const e=o.keys?.[n];if(e===void 0||e.kind==="prop"){const t=e?.as??n;c.set(t,{key:t,value:{kind:"literal",value:s}});continue}if(e.kind==="transform"){const t=e.as??n;c.set(t,{key:t,value:{kind:"literal",value:e.apply(s)}});continue}if(e.kind==="planOnly"){i.push({key:n,reason:e.reason,kind:"plan-only"});continue}const d=e.bind(s,a);if(d===void 0){i.push({key:n,reason:e.reason,kind:"unresolved-binding"});continue}const l=e.as??n;c.set(l,{key:l,value:{kind:"expression",source:d}})}return{props:[...c.values()],unprojectable:i}}f(b,"projectPlanToConstructProps");export{b as projectPlanToConstructProps};
+var h=Object.defineProperty;var p=(t,i)=>h(t,"name",{value:i,configurable:!0});import{isProjectableType as j,TYPE_PROJECTIONS as f}from"./tables.js";function P(t){return j(t)?f[t].constructKeyAliases??{}:{}}p(P,"constructKeyAliasesFor");function K(t,i){return(f[t].crossKey??[]).filter(e=>e.refuseWhen(i)).map(e=>({key:e.property,reason:e.reason,kind:"cross-key"}))}p(K,"crossKeyUnprojectables");function E(t,i,r={}){const e=f[t],u=[];r.editingExisting!==!0&&u.push(...K(t,i));let a=[];if(r.editingExisting!==!0)if(typeof e.constants=="function"){const n=e.constants(r);a=n.props,u.push(...n.unprojectable.map(c=>({...c,kind:c.kind??"missing-context"})))}else a=e.constants??[];const d=new Map(a.map(n=>[n.key,n])),g=new Set([...e.siblings?.keys??[],...e.expansion?.keys??[]]);let l;if(e.siblings!==void 0&&e.siblings.keys.some(n=>i[n]!==void 0)){const n=e.siblings.derive(i,r);l=n.siblings,u.push(...n.unprojectable)}let k=[];if(e.expansion!==void 0&&e.expansion.keys.some(n=>i[n]!==void 0)){const n=e.expansion.derive(i,r);k=n.props,u.push(...n.unprojectable)}for(const[n,c]of Object.entries(i)){if(c===void 0||g.has(n))continue;const s=e.keys?.[n];if(s===void 0||s.kind==="prop"){const o=s?.as??n;d.set(o,{key:o,value:{kind:"literal",value:c}});continue}if(s.kind==="transform"){const o=s.as??n;d.set(o,{key:o,value:{kind:"literal",value:s.apply(c)}});continue}if(s.kind==="planOnly"){u.push({key:n,reason:s.reason,kind:"plan-only"});continue}if(s.kind==="structured"){const o=s.build(c,r);if(o===void 0){u.push({key:n,reason:s.reason,kind:"unresolved-binding"});continue}const v=s.as??n;d.set(v,{key:v,value:{kind:"structured",expression:o.expression,...o.imports!==void 0&&{imports:o.imports}}});continue}const y=s.bind(c,r);if(y===void 0){u.push({key:n,reason:s.reason,kind:"unresolved-binding"});continue}const b=s.as??n;d.set(b,{key:b,value:{kind:"expression",source:y}})}for(const n of k)d.set(n.key,n);return{props:[...d.values()],unprojectable:u,...l!==void 0&&{siblings:l}}}p(E,"projectPlanToConstructProps");export{P as constructKeyAliasesFor,K as crossKeyUnprojectables,E as projectPlanToConstructProps};

package/dist/src/projection/roundTripKeys.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The plan's two round-trip preservation keys, declared once and consumed by
+ * every per-type table (`tables.ts` and `compute.ts` both spread
+ * {@link roundTripKeys}): `variableName` names the `const <var> =` binding
+ * the scaffold emits, `extraProperties` is flattened into sibling properties
+ * by `emitExtraProperties` — and neither survives as a construct prop
+ * anywhere.
+ */
+import type { PlanKeyRule } from "./types.js";
+export declare const variableNameKey: PlanKeyRule;
+export declare const extraPropertiesKey: PlanKeyRule;
+export declare const roundTripKeys: Record<string, PlanKeyRule>;

package/dist/src/projection/roundTripKeys.js

@@ -0,0 +1 @@
+const e={kind:"planOnly",reason:"`variableName` is a plan-only round-trip key naming the `const <var> =` binding the scaffold emits; no construct reads it."},r={kind:"planOnly",reason:"`extraProperties` is a plan-only round-trip key: the scaffold flattens each `{ key, sourceText }` entry into a sibling property, and no construct reads the array."},a={variableName:e,extraProperties:r};export{r as extraPropertiesKey,a as roundTripKeys,e as variableNameKey};

package/dist/src/projection/tables.d.ts

@@ -7,16 +7,19 @@
  * carried over verbatim where they still apply, because they record what was
  * actually observed to happen at synth — not what the vocabulary suggests.
  *
- * Two plan keys recur on nearly every type and are declared once:
- * `variableName` (the `const <var> =` binding the scaffold emits) and
- * `extraProperties` (round-trip preservation the scaffold flattens into
- * sibling properties). Neither is a construct prop anywhere.
+ * Two plan keys recur on nearly every type and are declared once, in
+ * `roundTripKeys.ts`: `variableName` (the `const <var> =` binding the
+ * scaffold emits) and `extraProperties` (round-trip preservation the
+ * scaffold flattens into sibling properties). Neither is a construct prop
+ * anywhere.
  *
- * `compute` and `vpc-peer` are deliberately ABSENT. A compute's four
- * connection keys expand into environment variables plus a whole second
- * statement (`app.addSchedule(...)`) — more than one statement is beyond
- * what a projection can emit, so it keeps its `emitGuard` table and a type
- * is projected or guarded, never both. `vpc-peer`'s rules are required-key
+ * `compute` lives in its own module (`compute.ts`) — its table carries the
+ * sibling projection (`scheduleExpression` → `app.addSchedule(...)`), the
+ * connection-key fragment expansion, the cross-key rules its schema
+ * `superRefine`s used to hold, and the construct-key aliases — and is
+ * registered here like every other type.
+ *
+ * Only `vpc-peer` is deliberately ABSENT: its rules are required-key
  * conditions whose absence deploys silently wrong infrastructure — guard
  * territory, not vocabulary.
  */
@@ -28,6 +31,7 @@ export declare const TYPE_PROJECTIONS: {
     readonly network: TypeProjection;
     readonly pattern: TypeProjection;
     readonly cdn: TypeProjection;
+    readonly compute: TypeProjection;
 };
 export type ProjectableType = keyof typeof TYPE_PROJECTIONS;
 export declare function isProjectableType(value: string): value is ProjectableType;

package/dist/src/projection/tables.js

@@ -1 +1 @@
-var s=Object.defineProperty;var n=(e,r)=>s(e,"name",{value:r,configurable:!0});import{toKebab as i}from"@fjall/util";const o={kind:"planOnly",reason:"`variableName` is a plan-only round-trip key naming the `const <var> =` binding the scaffold emits; no construct reads it."},t={kind:"planOnly",reason:"`extraProperties` is a plan-only round-trip key: the scaffold flattens each `{ key, sourceText }` entry into a sibling property, and no construct reads the array."},a={variableName:o,extraProperties:t},l={constants:[{key:"type",value:{kind:"literal",value:"queue"}}],keys:{retentionPeriod:{kind:"prop",as:"messageRetentionPeriod"},...a}},d={keys:{...a}},p={keys:{engineExpression:{kind:"planOnly",reason:"`engineExpression` carries a raw CDK engine expression for the scaffold to inline; the construct reads `databaseEngine` instead, so a cluster pinned to `DatabaseClusterEngine.auroraMysql(...)` still deploys as aurora-postgresql."},...a}},c={keys:{...a}},u={constants:n(e=>e.resourceName!==void 0?{props:[{key:"name",value:{kind:"literal",value:i(e.resourceName)}}],unprojectable:[]}:{props:[],unprojectable:[{key:"name",reason:"every pattern construct reads a `name` prop (`toPascalCase(props.name)` names its child constructs), and this caller supplied no resource name to derive it from."}]},"constants")},y={constants:[{key:"originType",value:{kind:"literal",value:"auto"}}],keys:{defaultOriginRef:{kind:"live",as:"origin",reason:"`defaultOriginRef` names a planned sibling resource and the construct reads a live `origin` binding in its place; no unique storage or compute binding for that name could be resolved in this file, and writing the name as a string would deploy a distribution treating it as an HTTP origin domain.",bind:n((e,r)=>typeof e=="string"?r.resolveBinding?.(e):void 0,"bind")},customDomain:{kind:"transform",as:"domainNames",apply:n(e=>[e],"apply")},behaviours:{kind:"planOnly",reason:"each `behaviours[].originRef` names a live origin PER ELEMENT, and a single-value binding cannot reach inside an array literal; the plan shape throws `Cannot read properties of undefined (reading 'computeType')` at synth."},extraProperties:t}},g={messaging:l,storage:d,database:p,network:c,pattern:u,cdn:y};function b(e){return Object.prototype.hasOwnProperty.call(g,e)}n(b,"isProjectableType");export{g as TYPE_PROJECTIONS,b as isProjectableType};
+var o=Object.defineProperty;var n=(e,a)=>o(e,"name",{value:a,configurable:!0});import{toKebab as t}from"@fjall/util";import{compute as r}from"./compute.js";import{extraPropertiesKey as s,roundTripKeys as i}from"./roundTripKeys.js";const d={constants:[{key:"type",value:{kind:"literal",value:"queue"}}],keys:{retentionPeriod:{kind:"prop",as:"messageRetentionPeriod"},...i}},c={keys:{...i}},m={keys:{engineExpression:{kind:"planOnly",reason:"`engineExpression` carries a raw CDK engine expression for the scaffold to inline; the construct reads `databaseEngine` instead, so a cluster pinned to `DatabaseClusterEngine.auroraMysql(...)` still deploys as aurora-postgresql."},...i}},p={keys:{...i}},u={constants:n(e=>e.resourceName!==void 0?{props:[{key:"name",value:{kind:"literal",value:t(e.resourceName)}}],unprojectable:[]}:{props:[],unprojectable:[{key:"name",reason:"every pattern construct reads a `name` prop (`toPascalCase(props.name)` names its child constructs), and this caller supplied no resource name to derive it from."}]},"constants")},f={constants:[{key:"originType",value:{kind:"literal",value:"auto"}}],keys:{defaultOriginRef:{kind:"live",as:"origin",reason:"`defaultOriginRef` names a planned sibling resource and the construct reads a live `origin` binding in its place; no unique storage or compute binding for that name could be resolved in this file, and writing the name as a string would deploy a distribution treating it as an HTTP origin domain.",bind:n((e,a)=>typeof e=="string"?a.resolveBinding?.(e):void 0,"bind")},customDomain:{kind:"transform",as:"domainNames",apply:n(e=>[e],"apply")},domain:{kind:"transform",as:"domainConfig",apply:n(e=>({domainName:e}),"apply")},behaviours:{kind:"planOnly",reason:"each `behaviours[].originRef` names a live origin PER ELEMENT, and a single-value binding cannot reach inside an array literal; the plan shape throws `Cannot read properties of undefined (reading 'computeType')` at synth."},extraProperties:s},crossKey:[{property:"domain",reason:"`domain` is the managed-domain lane (the construct resolves zone and certificate from the injected managed-domain binding) and `customDomain` is the BYO lane \u2014 the construct refuses `domainConfig` beside `domainNames`. Pass one or the other.",refuseWhen:n(e=>e.domain!==void 0&&e.customDomain!==void 0,"refuseWhen")},{property:"domain",reason:"`domain` resolves its certificate from the managed-domain binding, so a BYO `certificateArn` beside it is refused by the construct (`domainConfig` excludes `certificateArn`). Pass one or the other.",refuseWhen:n(e=>e.domain!==void 0&&e.certificateArn!==void 0,"refuseWhen")},{property:"domain",reason:"this statement already carries `domainNames` (the BYO lane) and `domain` projects to `domainConfig` \u2014 the construct refuses the pair. Drop `domainNames` first, or keep the BYO lane and drop `domain`.",refuseWhen:n(e=>e.domain!==void 0&&e.domainNames!==void 0,"refuseWhen")},{property:"domain",reason:"this statement already carries a `certificate` and `domain` projects to `domainConfig` \u2014 the construct refuses the pair. Drop `certificate` first, or keep the BYO lane and drop `domain`.",refuseWhen:n(e=>e.domain!==void 0&&e.certificate!==void 0,"refuseWhen")},{property:"domain",reason:"this statement already carries a `domainConfig` and `domain` projects to a second one \u2014 the plan key would silently REPLACE the existing `domainConfig`, discarding whatever richer shape it carries. Modify the existing `domainConfig` instead.",refuseWhen:n(e=>e.domain!==void 0&&e.domainConfig!==void 0,"refuseWhen")},{property:"customDomain",reason:"this statement already carries a `domainConfig` (the managed-domain lane) and `customDomain` projects to `domainNames` \u2014 the construct refuses the pair. Drop `domainConfig` first, or keep the managed lane and pass `domain` instead.",refuseWhen:n(e=>e.customDomain!==void 0&&e.domainConfig!==void 0,"refuseWhen")},{property:"certificateArn",reason:"this statement already carries a `domainConfig`, which resolves its certificate from the managed-domain binding \u2014 a BYO `certificateArn` beside it is refused by the construct (`domainConfig` excludes `certificateArn`). Drop `domainConfig` first, or let the managed lane keep the certificate.",refuseWhen:n(e=>e.certificateArn!==void 0&&e.domainConfig!==void 0,"refuseWhen")}]},l={messaging:d,storage:c,database:m,network:p,pattern:u,cdn:f,compute:r};function k(e){return Object.prototype.hasOwnProperty.call(l,e)}n(k,"isProjectableType");export{l as TYPE_PROJECTIONS,k as isProjectableType};

package/dist/src/projection/types.d.ts

@@ -18,10 +18,82 @@
  * claim true; until then, a table entry proves the codemod's behaviour and
  * only documents the scaffold's.
  */
+/**
+ * An expression the emitters can build WITHOUT splicing free text: every
+ * identifier segment (an identifier's name, a member access's property, a
+ * call argument's identifier) is validated against the emitter's identifier
+ * pattern and reserved-word set before a node is built, so no rule can smuggle
+ * arbitrary source into the file. `member` and `call` compose recursively
+ * through their `object`/`callee`, which is how `getConfig().environment` and
+ * `Runtime.NODEJS_22_X` are expressed.
+ */
+export type StructuredExpression = {
+    kind: "identifier";
+    name: string;
+} | {
+    kind: "member";
+    object: StructuredExpression;
+    property: string;
+} | {
+    kind: "call";
+    callee: StructuredExpression;
+    args: ReadonlyArray<StructuredCallArgument>;
+}
+/**
+ * The primary statement's construct value, usable ONLY inside a sibling
+ * statement's props: the sibling engine substitutes it with the identifier
+ * it bound the primary under (`const`-wrapping the primary if needed). The
+ * serialiser refuses an unsubstituted marker fail-closed, so no other path
+ * can emit it.
+ */
+ | {
+    kind: "primary-binding";
+};
+/** A call argument: a serialisable literal or a validated identifier. */
+export type StructuredCallArgument = {
+    kind: "literal";
+    value: unknown;
+} | {
+    kind: "identifier";
+    name: string;
+};
+export interface StructuredObjectEntry {
+    key: string;
+    value: StructuredValue;
+}
+/**
+ * A structured prop value: a serialisable literal, an object/array whose
+ * entries are themselves structured values (so an env record can mix literal
+ * strings with accessor calls), or a {@link StructuredExpression}.
+ */
+export type StructuredValue = {
+    kind: "literal";
+    value: unknown;
+} | {
+    kind: "object";
+    entries: ReadonlyArray<StructuredObjectEntry>;
+} | {
+    kind: "array";
+    elements: ReadonlyArray<StructuredValue>;
+} | StructuredExpression;
+/**
+ * What a `structured` rule resolves to: the expression to emit, plus any
+ * named imports it needs from the components barrel
+ * (`@fjall/components-infrastructure`). Imports are barrel specifiers ONLY —
+ * the emitters append them to the existing components import line (or create
+ * one); no other module may be named, so a rule cannot introduce a second
+ * import-management path.
+ */
+export interface StructuredBinding {
+    expression: StructuredValue;
+    imports?: readonly string[];
+}
 /**
  * A construct prop's value. `literal` is a plain JS value the emitter
- * serialises; `expression` is TypeScript source spliced in verbatim, which
- * only a caller that can supply live bindings may ask for.
+ * serialises; `expression` is the NAME of a live binding, spliced as a bare
+ * identifier by callers that can supply live bindings; `structured` is a
+ * validated expression tree (plus its barrel imports) built segment by
+ * segment — never free source text.
  */
 export type ProjectedValue = {
     kind: "literal";
@@ -29,6 +101,10 @@ export type ProjectedValue = {
 } | {
     kind: "expression";
     source: string;
+} | {
+    kind: "structured";
+    expression: StructuredValue;
+    imports?: readonly string[];
 };
 /** One construct prop, in construct vocabulary. */
 export interface ProjectedProp {
@@ -47,8 +123,11 @@ export interface ProjectedProp {
  *   statement is refused and nothing is written at all.
  * - `missing-context` — a constants factory needed something the command
  *   context did not carry (the resource name); again nothing is written.
+ * - `cross-key` — no single key is at fault: a {@link CrossKeyRule} judged the
+ *   fragment as a whole and found a combination the construct cannot deploy
+ *   as asked; nothing is written.
  */
-export type UnprojectableKind = "plan-only" | "unresolved-binding" | "missing-context";
+export type UnprojectableKind = "plan-only" | "unresolved-binding" | "missing-context" | "cross-key";
 /**
  * A plan key this context cannot turn into a construct prop, and why. The
  * scaffold ignores these — it consumes such keys through its own paths. The
@@ -67,6 +146,68 @@ export interface UnprojectableProp {
 export interface Projection {
     props: ProjectedProp[];
     unprojectable: UnprojectableProp[];
+    /**
+     * Statements the fragment's sibling-owned keys expand into, present only
+     * when a {@link SiblingProjection} fired. The add path emits them after the
+     * primary statement; modify refuses them fail-closed — it edits exactly one
+     * statement.
+     */
+    siblings?: SiblingStatement[];
+}
+/**
+ * One statement a sibling-owned plan key expands into:
+ * `app.<appMethod>("<constructId>", { …props })` — an app-method call with no
+ * factory, which is the shape connection statements take. `planKey` names the
+ * plan key that asked for it, so every refusal about the sibling points at a
+ * flag the operator typed.
+ */
+export interface SiblingStatement {
+    planKey: string;
+    constructId: string;
+    appMethod: string;
+    props: ProjectedProp[];
+}
+/** What a {@link SiblingProjection}'s `derive` resolves the owned keys to. */
+export interface SiblingDerivation {
+    siblings: SiblingStatement[];
+    unprojectable: UnprojectableProp[];
+}
+/**
+ * The projection for plan keys that expand BEYOND the primary statement —
+ * compute's `scheduleExpression` is the motivating case: one plan key becomes
+ * a whole second statement (`app.addSchedule(...)` targeting the primary),
+ * not a prop. `keys` are owned exclusively: the engine strips them from
+ * per-key dispatch and hands the whole fragment to `derive` whenever any
+ * owned key is defined. A derivation that cannot resolve reports through
+ * `unprojectable` — the same refusal channel every other rule uses.
+ */
+export interface SiblingProjection {
+    keys: ReadonlyArray<string>;
+    derive: (fragment: Readonly<Record<string, unknown>>, context: ProjectionContext) => SiblingDerivation;
+}
+/** What a {@link FragmentExpansion}'s `derive` resolves the owned keys to. */
+export interface ExpansionDerivation {
+    props: ProjectedProp[];
+    unprojectable: UnprojectableProp[];
+}
+/**
+ * The projection for plan keys that merge into SHARED construct props rather
+ * than mapping one-to-one — compute's connection keys are the motivating
+ * case: `connectedDatabase`, `connectedStorage`, `connectedMessaging` and
+ * the user's own `environment` record all feed ONE `environment` construct
+ * prop (plus `secretsImport` and `connections`), so no per-key rule can
+ * build any of them alone. `keys` are owned exclusively, exactly as a
+ * {@link SiblingProjection}'s are: the engine strips them from per-key
+ * dispatch and hands the whole fragment to `derive` whenever any owned key
+ * is defined. Derived props land AFTER the per-key loop, so a derived prop
+ * replaces a passed-through prop under the same construct key — deliberate:
+ * the expansion consumed that key's value and rebuilt it. A derivation that
+ * cannot resolve reports through `unprojectable` — the same refusal channel
+ * every other rule uses.
+ */
+export interface FragmentExpansion {
+    keys: ReadonlyArray<string>;
+    derive: (fragment: Readonly<Record<string, unknown>>, context: ProjectionContext) => ExpansionDerivation;
 }
 /**
  * What the caller can offer beyond the plan fragment itself.
@@ -77,7 +218,20 @@ export interface Projection {
  * and a key needing a live sibling is unprojectable for it.
  */
 export interface ProjectionContext {
-    resolveBinding?: (planResourceName: string) => string | undefined;
+    /**
+     * `planKey` narrows the candidate types when the supplier keys them per
+     * plan key (compute's connection keys each bind exactly one resource
+     * type); without it, the supplier's default candidate set applies.
+     */
+    resolveBinding?: (planResourceName: string, planKey?: string) => string | undefined;
+    /**
+     * All-or-nothing array form of {@link resolveBinding}: every name resolves
+     * or the whole call answers `undefined`, with any side effects of the
+     * successful prefix rolled back. An array plan key (compute's
+     * `connectedStorage: ["Uploads", "Assets"]`) must never bind a subset —
+     * emitting half the connections is worse than refusing.
+     */
+    resolveBindings?: (planResourceNames: ReadonlyArray<string>, planKey?: string) => ReadonlyArray<string> | undefined;
     /**
      * The name of the resource the statement is for, when the caller has one
      * (`fjall add` always does — it is the factory's first argument). A
@@ -109,6 +263,12 @@ export interface ProjectionContext {
  * - `live` — the construct wants an object, not a value. `bind` gets the plan
  *   value and the context and returns the source text of an expression, or
  *   undefined when this context cannot produce one.
+ * - `structured` — the construct wants an expression no literal can carry
+ *   (an enum member access, an accessor call, an env record mixing both).
+ *   `build` returns a {@link StructuredBinding} — a validated expression tree
+ *   plus its barrel imports — or undefined when this context cannot produce
+ *   one, which refuses the key as `unresolved-binding` exactly as an
+ *   unresolved `live` bind does.
  */
 export type PlanKeyRule = {
     kind: "prop";
@@ -125,7 +285,26 @@ export type PlanKeyRule = {
     as?: string;
     reason: string;
     bind: (value: unknown, context: ProjectionContext) => string | undefined;
+} | {
+    kind: "structured";
+    as?: string;
+    reason: string;
+    build: (value: unknown, context: ProjectionContext) => StructuredBinding | undefined;
 };
+/**
+ * A rule judged over the WHOLE fragment rather than one key: some
+ * combinations of keys deploy wrong no matter how each key projects alone (a
+ * code-deployed Lambda with no `code`, a public bucket serving nothing).
+ * `property` attributes the refusal to the plan key the operator can act on;
+ * `refuseWhen` sees the fragment verbatim — on a modify judge that includes
+ * `UNRESOLVED` markers for non-literal values (`projection/unresolved.ts`),
+ * which a rule must read as PRESENT, never absent.
+ */
+export interface CrossKeyRule {
+    property: string;
+    reason: string;
+    refuseWhen: (fragment: Readonly<Record<string, unknown>>) => boolean;
+}
 /**
  * One resource type's projection.
  *
@@ -140,8 +319,29 @@ export type PlanKeyRule = {
  * `keys` is consulted per plan key; a key with no entry passes through under
  * its own name, which is the common case and is why the tables stay short
  * enough to read as the specification they are.
+ *
+ * `crossKey` rules run over the whole fragment when it describes a whole
+ * statement — never over a bare edit fragment (`editingExisting`), where an
+ * untouched key's absence would fire them falsely; the modify judge instead
+ * evaluates them over its merged whole-statement views.
  */
 export interface TypeProjection {
     constants?: ProjectedProp[] | ((context: ProjectionContext) => Projection);
     keys?: Record<string, PlanKeyRule>;
+    crossKey?: ReadonlyArray<CrossKeyRule>;
+    siblings?: SiblingProjection;
+    expansion?: FragmentExpansion;
+    /**
+     * Alternate spellings an EXISTING statement may carry for a canonical
+     * construct key, consumed by the modify path only: an edit that projects
+     * to the canonical key lands ON the alias-named property (replacing it in
+     * place, position preserved) rather than appending a second key beside it
+     * — two props contending for one construct slot is how an edit silently
+     * loses to a stale twin. A direct hit on the canonical key removes any
+     * alias-named twins for the same reason. Keyed by canonical construct
+     * key; values are the alias spellings (scaffold-era drift, plan-vocabulary
+     * leaks). The add path never consults this — it writes canonical keys
+     * only.
+     */
+    constructKeyAliases?: Readonly<Record<string, ReadonlyArray<string>>>;
 }

package/dist/src/projection/unresolved.d.ts

@@ -0,0 +1,17 @@
+/**
+ * A value the codemod could not have written: the property is present in the
+ * statement under judgement but holds a non-literal expression
+ * (`Code.fromAsset("./src")`, `Runtime.NODEJS_20_X`, `assetsBucket`).
+ *
+ * Its presence is PROOF the statement was authored by a human or by the
+ * generator scaffold, both of which speak construct vocabulary. Rules that
+ * refuse a key because the construct needs a live value must therefore treat
+ * `UNRESOLVED` as satisfying the construct — otherwise `fjall modify` would
+ * refuse to touch perfectly good scaffold output. The ADD path never produces
+ * it: every value there comes from a flag.
+ *
+ * Declared here, in the projection's own vocabulary, so `crossKey` rules in
+ * the tables can consult it without the projection importing from the
+ * codemod; `codemod/emitGuard.ts` re-exports it for its historical importers.
+ */
+export declare const UNRESOLVED: unique symbol;

package/dist/src/projection/unresolved.js

@@ -0,0 +1 @@
+const e=Symbol("unresolved-expression");export{e as UNRESOLVED};

package/dist/src/schemas/applicationSchemas.d.ts

@@ -851,6 +851,8 @@ export declare const ApplicationResourcePlanSchema: z.ZodObject<{
         }, z.core.$strict>>>;
         customDomain: z.ZodOptional<z.ZodString>;
         certificateArn: z.ZodOptional<z.ZodString>;
+        domain: z.ZodOptional<z.ZodString>;
+        originHostname: z.ZodOptional<z.ZodString>;
         accessGate: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
             type: z.ZodLiteral<"basic-auth">;
             username: z.ZodString;

package/dist/src/schemas/cdnSchemas.d.ts

@@ -26,6 +26,8 @@ export declare const CDNResourcePlanSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     customDomain: z.ZodOptional<z.ZodString>;
     certificateArn: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    originHostname: z.ZodOptional<z.ZodString>;
     accessGate: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
         type: z.ZodLiteral<"basic-auth">;
         username: z.ZodString;
@@ -50,6 +52,8 @@ export declare const CdnGeneratorSchema: z.ZodObject<{
     }, z.core.$strict>>>;
     customDomain: z.ZodOptional<z.ZodString>;
     certificateArn: z.ZodOptional<z.ZodString>;
+    domain: z.ZodOptional<z.ZodString>;
+    originHostname: z.ZodOptional<z.ZodString>;
     accessGate: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
         type: z.ZodLiteral<"basic-auth">;
         username: z.ZodString;

package/dist/src/schemas/cdnSchemas.js

@@ -1 +1 @@
-import{z as t}from"zod";import{ResourceNameSchema as a,ExtraPropertySchema as o}from"./baseSchemas.js";const e=t.object({type:t.literal("basic-auth"),username:t.string().min(1),password:t.string().min(1)}).strict(),n=t.object({name:a,defaultOriginRef:t.string(),behaviours:t.array(t.object({pathPattern:t.string(),originRef:t.string(),cachePolicy:t.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:t.string().optional(),certificateArn:t.string().optional(),accessGate:t.union([t.literal(!1),e]).optional(),extraProperties:t.array(o).optional()}).strict(),s=t.object({appName:t.string(),name:a.optional(),defaultOriginRef:t.string(),behaviours:t.array(t.object({pathPattern:t.string(),originRef:t.string(),cachePolicy:t.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:t.string().optional(),certificateArn:t.string().optional(),accessGate:t.union([t.literal(!1),e]).optional(),nameProvidedByFlag:t.boolean().optional()}).strict();export{e as AccessGateSchema,n as CDNResourcePlanSchema,s as CdnGeneratorSchema};
+import{z as t}from"zod";import{ResourceNameSchema as o,ExtraPropertySchema as a}from"./baseSchemas.js";const i=t.object({type:t.literal("basic-auth"),username:t.string().min(1),password:t.string().min(1)}).strict(),e=t.object({name:o,defaultOriginRef:t.string(),behaviours:t.array(t.object({pathPattern:t.string(),originRef:t.string(),cachePolicy:t.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:t.string().optional(),certificateArn:t.string().optional(),domain:t.string().optional(),originHostname:t.string().optional(),accessGate:t.union([t.literal(!1),i]).optional(),extraProperties:t.array(a).optional()}).strict(),s=t.object({appName:t.string(),name:o.optional(),defaultOriginRef:t.string(),behaviours:t.array(t.object({pathPattern:t.string(),originRef:t.string(),cachePolicy:t.enum(["CACHING_OPTIMIZED","CACHING_DISABLED"]).optional()}).strict()).optional(),customDomain:t.string().optional(),certificateArn:t.string().optional(),domain:t.string().optional(),originHostname:t.string().optional(),accessGate:t.union([t.literal(!1),i]).optional(),nameProvidedByFlag:t.boolean().optional()}).strict();export{i as AccessGateSchema,e as CDNResourcePlanSchema,s as CdnGeneratorSchema};

package/dist/src/schemas/computeSchemas.js

@@ -1 +1 @@
-var W=Object.defineProperty;var h=(n,t)=>W(n,"name",{value:t,configurable:!0});import{z as e}from"zod";import{VALIDATION_PATTERNS as m,VALIDATION_MESSAGES as o}from"../validation/patterns.js";import{COMPUTE_TYPES as f,ECS_CAPACITY_PROVIDERS as x,EC2_INSTANCE_TYPES as w,HTTP_METHODS as V,MIN_LAMBDA_MEMORY as K,MAX_LAMBDA_MEMORY as F,MIN_LAMBDA_TIMEOUT as S,MAX_LAMBDA_TIMEOUT as g,MIN_ECS_CAPACITY as O,MAX_ECS_CAPACITY as L,MAX_SCALING_CAPACITY as p,MAX_WARM_POOL_SIZE as Z,constIncludes as z,COMPUTE_ARCHITECTURES as Q,FUNCTION_URL_AUTH_TYPES as H,DEPLOYMENT_TYPES as $,AMI_HARDWARE_TYPES as q,LOAD_BALANCER_TYPES as J,SCALING_TYPES as ee,ECS_SERVICE_TYPES as D}from"./constants.js";import{validateArchitectureMatch as oe,getArchitectureForInstanceType as ne}from"./instanceTypeArchitecture.js";import{optionalOrDisabled as te,CAPACITY_REFINEMENT as r,memoryLimitMiBSchema as I,ResourceNameSchema as c,AppNameSchema as s,PortSchema as T,ExtraPropertySchema as l,EnvironmentRecordSchema as E,SecretsImportRecordSchema as ie}from"./baseSchemas.js";import{DockerBuildSchema as A}from"@fjall/util/manifest/schemas";import{EcsServiceAlarmConfigSchema as ae,LambdaAlarmConfigSchema as re}from"./alarmSchemas.js";function ce(n){return!(n.image!==void 0&&n.docker!==void 0)}h(ce,"imageDockerMutexCheck");const G=e.number().int(o.CAPACITY.MIN.INTEGER).min(O,o.GENERATOR_CAPACITY.MIN.MIN).max(L,o.GENERATOR_CAPACITY.MIN.MAX),Y=e.number().int(o.CAPACITY.MAX.INTEGER).min(O,o.GENERATOR_CAPACITY.MAX.MIN).max(L,o.GENERATOR_CAPACITY.MAX.MAX),N=e.number().int(o.LAMBDA.MEMORY.INTEGER).min(K,o.LAMBDA.MEMORY.MIN).max(F,o.LAMBDA.MEMORY.MAX).refine(n=>n===128||n%64===0,o.LAMBDA.MEMORY.MULTIPLE),v=e.string().regex(m.LAMBDA_RUNTIME_IDENTIFIER,o.LAMBDA.RUNTIME),d=e.number().int(o.CPU.INTEGER).min(256,o.CPU.MIN).max(4096,o.CPU.MAX),u=e.number().int(o.CAPACITY.DESIRED.INTEGER).min(0,o.CAPACITY.DESIRED.MIN).max(p,o.CAPACITY.DESIRED.MAX),C=e.object({connectToDatabase:e.array(e.string()).optional()}).strict(),se=e.object({minSize:e.number().int(o.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,o.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(Z,o.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:e.boolean().optional()}).strict(),_=e.object({instanceType:e.string().optional(),amiHardwareType:e.enum(q).optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:I(128).optional(),warmPool:se.optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(!n.instanceType||!n.amiHardwareType)return;const i=oe(n.instanceType,n.amiHardwareType);i.valid||t.addIssue({code:"custom",message:i.message??o.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((n,t)=>{n.minCapacity===0&&!n.warmPool&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),n.warmPool?.minSize!==void 0&&n.maxCapacity!==void 0&&n.warmPool.minSize>n.maxCapacity&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),me=e.enum(f).describe(`Compute type must be one of: ${f.join(", ")}`),y=e.enum(x).describe(`ECS capacity provider must be one of: ${x.join(", ")}`),P=e.string().refine(n=>z(w,n),{message:o.INSTANCE_TYPE}),U=e.object({sourceType:e.enum(["sqs","dynamodb","eventbridge"]),sourceRef:e.string().describe("Name of the source resource"),batchSize:e.number().int(o.BATCH_SIZE.INTEGER).min(1,o.BATCH_SIZE.MIN).max(1e4,o.BATCH_SIZE.MAX).optional(),startingPosition:e.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:e.number().int(o.BATCHING_WINDOW.INTEGER).min(0,o.BATCHING_WINDOW.MIN).max(300,o.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:e.boolean().optional()}).strict(),pe=e.object({name:e.string().min(1,o.REQUIRED.CONTAINER_NAME).optional(),image:e.string().optional(),port:T.optional(),environment:E.optional(),secretsImport:ie.optional(),command:e.array(e.string()).optional(),entryPoint:e.array(e.string()).optional(),essential:e.boolean().optional(),healthCheck:e.object({command:e.array(e.string()),interval:e.number().int(o.HEALTH_CHECK.INTERVAL.INTEGER).min(5,o.HEALTH_CHECK.INTERVAL.MIN).max(300,o.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:e.number().int(o.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,o.HEALTH_CHECK.TIMEOUT.MIN).max(60,o.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:e.number().int(o.HEALTH_CHECK.RETRIES.INTEGER).min(1,o.HEALTH_CHECK.RETRIES.MIN).max(10,o.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:e.number().int(o.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,o.HEALTH_CHECK.START_PERIOD.MIN).max(300,o.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:e.array(e.string().regex(m.SECRET_NAME,o.SECRET_NAME)).optional(),extraProperties:e.array(l).optional()}).strict(),B=e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.ECS_SERVICE_NAME,o.ECS_SERVICE_NAME),X=e.object({domain:e.string().optional(),loadBalancer:e.union([e.literal(!1),e.enum(J)]).optional(),directAccess:e.boolean().optional(),extraProperties:e.array(l).optional()}).strict().refine(n=>!(n.directAccess&&n.domain),{message:o.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(n=>!(n.directAccess&&typeof n.loadBalancer=="string"),{message:o.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),M=e.object({path:e.string().optional(),host:e.string().optional(),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional(),healthCheckPath:e.string().optional()}).strict().describe("Path/host-based routing configuration"),le=e.object({desiredCount:u.optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),scalingType:e.enum(ee).optional()}).strict().refine(r.check,r.params).describe("ECS service scaling configuration"),j=e.object({name:B,docker:A.optional(),needsDatabaseConnection:e.boolean().optional(),needsStorageConnection:e.boolean().optional(),needsMessagingConnection:e.boolean().optional(),image:e.string().optional(),containers:e.array(pe).optional(),routing:e.union([M,e.array(M).min(1)]).optional(),serviceType:e.enum(D).optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),scaling:te(le).optional(),capacityProvider:y,ec2Config:_.optional(),ssmSecretsPath:e.string().regex(m.SSM_PATH,o.SSM_PATH).optional(),extraProperties:e.array(l).optional(),alarms:ae.optional()}).strict().superRefine((n,t)=>{ce(n)||t.addIssue({code:"custom",path:["docker"],message:o.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),de=e.object({name:c,type:me,needsConnection:e.boolean(),connectedDatabase:e.array(e.string()).optional(),connectedStorage:e.array(e.string()).optional(),connectedMessaging:e.array(e.string()).optional(),cluster:X.optional(),services:e.array(j).optional(),docker:A.partial().optional(),deployment:e.enum($).optional(),codePath:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:v.optional(),environment:E.optional(),secrets:E.optional(),eventSources:e.array(U).optional(),functionUrl:e.object({authType:e.enum(H)}).strict().optional(),description:e.string().optional(),scheduleExpression:e.string().optional(),architecture:e.enum(Q).optional(),ephemeralStorageSize:e.number().int(o.EPHEMERAL_STORAGE.INTEGER).min(512,o.EPHEMERAL_STORAGE.MIN).max(10240,o.EPHEMERAL_STORAGE.MAX).optional(),functionName:e.string().optional(),ssmSecrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),alarms:re.optional(),instanceType:P.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional(),variableName:e.string().optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(n.type==="ecs"&&n.services)for(let i=0;i<n.services.length;i++){const a=n.services[i];a?.ec2Config?.instanceType&&!a.ec2Config.amiHardwareType&&ne(a.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${a.name??i}' uses instance type '${a.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",i,"ec2Config","instanceType"]})}n.type==="lambda"&&n.deployment==="container"&&n.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),_e=e.object({appName:s,clusterName:c,containerPort:T,nameProvidedByFlag:e.boolean().optional(),ecrRepository:e.string().optional(),capacityProvider:y.optional(),useAppEcr:e.boolean().optional(),desiredCount:u.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),minCapacity:G.optional(),maxCapacity:Y.optional(),ec2Config:_.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),ye=e.object({appName:s,functionName:c,nameProvidedByFlag:e.boolean().optional(),lambdaType:e.enum(["basic","web","custom"]).optional(),ecrRepository:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),enableFunctionUrl:e.boolean().optional(),description:e.string().optional(),enableCors:e.boolean().optional(),corsOrigins:e.string().optional(),corsHeaders:e.string().optional(),corsMethods:e.array(e.enum(V)).optional(),corsCredentials:e.boolean().optional(),connectionConfig:C.optional()}).strict(),Pe=e.object({appName:s,instanceName:c,nameProvidedByFlag:e.boolean().optional(),instanceType:P.optional(),enableSSH:e.boolean().optional(),minCapacity:G.optional(),maxCapacity:Y.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),be=e.object({appName:s,clusterName:c,serviceName:B,capacityProvider:y,containerPort:T.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),ec2Config:_.optional(),routing:e.union([M,e.array(M).min(1)]).optional(),docker:A.partial().optional(),nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),b=e.object({appName:s,computeName:c,nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),Ee=b.extend({type:e.literal("ecs"),cluster:X.optional(),services:e.array(j).min(1,o.SERVICE.MIN_REQUIRED),docker:A.partial().optional()}).strict().refine(n=>{const t=n.services.filter(i=>i.containers?.some(a=>a.port));return t.length>1?t.every(i=>(Array.isArray(i.routing)?i.routing:i.routing?[i.routing]:[]).some(R=>R.path||R.host)):!0},{message:o.SERVICE.ROUTING_REQUIRED}).refine(n=>{const t=n.services.map(i=>i.name);return new Set(t).size===t.length},{message:o.SERVICE.UNIQUE_WITHIN_CLUSTER}),Ae=b.extend({type:e.literal("lambda"),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:v.optional(),environment:E.optional(),secrets:E.optional(),description:e.string().optional(),functionUrl:e.union([e.object({authType:e.enum(H).optional()}).strict(),e.literal(!1)]).optional(),eventSources:e.array(U).optional()}).strict(),Ce=b.extend({type:e.literal("ec2"),instanceType:P.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional()}).strict(),he=e.discriminatedUnion("type",[Ee,Ae,Ce]),k=e.object({path:e.string().min(1,o.REQUIRED.ROUTING_PATH),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional()}).strict(),fe=e.object({name:e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.RESOURCE_NAME,o.RESOURCE_NAME),serviceType:e.enum(D).optional(),docker:A.partial().optional(),containerPort:T.optional(),needsDatabaseConnection:e.boolean().optional(),routing:e.union([k,e.array(k).min(1)]).optional()}).strict().superRefine((n,t)=>{n.serviceType==="worker"&&(n.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),n.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),xe=e.object({appName:s,instanceType:e.string().optional()}).strict();export{be as AddServiceGeneratorSchema,fe as ApplicationServiceConfigSchema,k as ApplicationServiceRoutingSchema,he as ComputeGeneratorSchema,de as ComputeResourcePlanSchema,me as ComputeTypeSchema,pe as ContainerConfigSchema,Pe as EC2GeneratorSchema,_e as ECSGeneratorSchema,_ as Ec2ConfigSchema,y as EcsCapacityProviderSchema,X as EcsClusterConfigSchema,M as EcsRoutingConfigSchema,le as EcsScalingConfigSchema,j as EcsServiceConfigSchema,B as EcsServiceNameSchema,P as InstanceTypeSchema,U as LambdaEventSourceSchema,ye as LambdaGeneratorSchema,N as LambdaMemorySchema,v as LambdaRuntimeSchema,xe as TunnelGeneratorSchema,se as WarmPoolSchema};
+var W=Object.defineProperty;var h=(n,t)=>W(n,"name",{value:t,configurable:!0});import{z as e}from"zod";import{VALIDATION_PATTERNS as m,VALIDATION_MESSAGES as o}from"../validation/patterns.js";import{COMPUTE_TYPES as f,ECS_CAPACITY_PROVIDERS as O,EC2_INSTANCE_TYPES as w,HTTP_METHODS as V,MIN_LAMBDA_MEMORY as K,MAX_LAMBDA_MEMORY as F,MIN_LAMBDA_TIMEOUT as S,MAX_LAMBDA_TIMEOUT as N,MIN_ECS_CAPACITY as x,MAX_ECS_CAPACITY as L,MAX_SCALING_CAPACITY as p,MAX_WARM_POOL_SIZE as Q,constIncludes as Z,COMPUTE_ARCHITECTURES as z,FUNCTION_URL_AUTH_TYPES as D,DEPLOYMENT_TYPES as $,AMI_HARDWARE_TYPES as q,LOAD_BALANCER_TYPES as J,SCALING_TYPES as ee,ECS_SERVICE_TYPES as H}from"./constants.js";import{validateArchitectureMatch as oe,getArchitectureForInstanceType as ne}from"./instanceTypeArchitecture.js";import{optionalOrDisabled as te,CAPACITY_REFINEMENT as r,memoryLimitMiBSchema as I,ResourceNameSchema as c,AppNameSchema as s,PortSchema as T,ExtraPropertySchema as E,EnvironmentRecordSchema as l,SecretsImportRecordSchema as ie}from"./baseSchemas.js";import{DockerBuildSchema as A}from"@fjall/util/manifest/schemas";import{EcsServiceAlarmConfigSchema as ae,LambdaAlarmConfigSchema as re}from"./alarmSchemas.js";function ce(n){return!(n.image!==void 0&&n.docker!==void 0)}h(ce,"imageDockerMutexCheck");const G=e.number().int(o.CAPACITY.MIN.INTEGER).min(x,o.GENERATOR_CAPACITY.MIN.MIN).max(L,o.GENERATOR_CAPACITY.MIN.MAX),U=e.number().int(o.CAPACITY.MAX.INTEGER).min(x,o.GENERATOR_CAPACITY.MAX.MIN).max(L,o.GENERATOR_CAPACITY.MAX.MAX),g=e.number().int(o.LAMBDA.MEMORY.INTEGER).min(K,o.LAMBDA.MEMORY.MIN).max(F,o.LAMBDA.MEMORY.MAX).refine(n=>n===128||n%64===0,o.LAMBDA.MEMORY.MULTIPLE),Y=e.string().regex(m.LAMBDA_RUNTIME_IDENTIFIER,o.LAMBDA.RUNTIME),d=e.number().int(o.CPU.INTEGER).min(256,o.CPU.MIN).max(4096,o.CPU.MAX),u=e.number().int(o.CAPACITY.DESIRED.INTEGER).min(0,o.CAPACITY.DESIRED.MIN).max(p,o.CAPACITY.DESIRED.MAX),C=e.object({connectToDatabase:e.array(e.string()).optional()}).strict(),se=e.object({minSize:e.number().int(o.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,o.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(Q,o.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:e.boolean().optional()}).strict(),_=e.object({instanceType:e.string().optional(),amiHardwareType:e.enum(q).optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:I(128).optional(),warmPool:se.optional(),extraProperties:e.array(E).optional()}).strict().superRefine((n,t)=>{if(!n.instanceType||!n.amiHardwareType)return;const i=oe(n.instanceType,n.amiHardwareType);i.valid||t.addIssue({code:"custom",message:i.message??o.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((n,t)=>{n.minCapacity===0&&!n.warmPool&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),n.warmPool?.minSize!==void 0&&n.maxCapacity!==void 0&&n.warmPool.minSize>n.maxCapacity&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),me=e.enum(f).describe(`Compute type must be one of: ${f.join(", ")}`),y=e.enum(O).describe(`ECS capacity provider must be one of: ${O.join(", ")}`),P=e.string().refine(n=>Z(w,n),{message:o.INSTANCE_TYPE}),v=e.object({sourceType:e.enum(["sqs","dynamodb","eventbridge"]),sourceRef:e.string().describe("Name of the source resource"),batchSize:e.number().int(o.BATCH_SIZE.INTEGER).min(1,o.BATCH_SIZE.MIN).max(1e4,o.BATCH_SIZE.MAX).optional(),startingPosition:e.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:e.number().int(o.BATCHING_WINDOW.INTEGER).min(0,o.BATCHING_WINDOW.MIN).max(300,o.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:e.boolean().optional()}).strict(),pe=e.object({name:e.string().min(1,o.REQUIRED.CONTAINER_NAME).optional(),image:e.string().optional(),port:T.optional(),environment:l.optional(),secretsImport:ie.optional(),command:e.array(e.string()).optional(),entryPoint:e.array(e.string()).optional(),essential:e.boolean().optional(),healthCheck:e.object({command:e.array(e.string()),interval:e.number().int(o.HEALTH_CHECK.INTERVAL.INTEGER).min(5,o.HEALTH_CHECK.INTERVAL.MIN).max(300,o.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:e.number().int(o.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,o.HEALTH_CHECK.TIMEOUT.MIN).max(60,o.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:e.number().int(o.HEALTH_CHECK.RETRIES.INTEGER).min(1,o.HEALTH_CHECK.RETRIES.MIN).max(10,o.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:e.number().int(o.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,o.HEALTH_CHECK.START_PERIOD.MIN).max(300,o.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:e.array(e.string().regex(m.SECRET_NAME,o.SECRET_NAME)).optional(),extraProperties:e.array(E).optional()}).strict(),B=e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.ECS_SERVICE_NAME,o.ECS_SERVICE_NAME),X=e.object({domain:e.string().optional(),loadBalancer:e.union([e.literal(!1),e.enum(J)]).optional(),directAccess:e.boolean().optional(),extraProperties:e.array(E).optional()}).strict().refine(n=>!(n.directAccess&&n.domain),{message:o.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(n=>!(n.directAccess&&typeof n.loadBalancer=="string"),{message:o.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),M=e.object({path:e.string().optional(),host:e.string().optional(),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional(),healthCheckPath:e.string().optional()}).strict().describe("Path/host-based routing configuration"),Ee=e.object({desiredCount:u.optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),scalingType:e.enum(ee).optional()}).strict().refine(r.check,r.params).describe("ECS service scaling configuration"),j=e.object({name:B,docker:A.optional(),needsDatabaseConnection:e.boolean().optional(),needsStorageConnection:e.boolean().optional(),needsMessagingConnection:e.boolean().optional(),image:e.string().optional(),containers:e.array(pe).optional(),routing:e.union([M,e.array(M).min(1)]).optional(),serviceType:e.enum(H).optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),scaling:te(Ee).optional(),capacityProvider:y,ec2Config:_.optional(),ssmSecretsPath:e.string().regex(m.SSM_PATH,o.SSM_PATH).optional(),extraProperties:e.array(E).optional(),alarms:ae.optional()}).strict().superRefine((n,t)=>{ce(n)||t.addIssue({code:"custom",path:["docker"],message:o.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),de=e.object({name:c,type:me,needsConnection:e.boolean(),connectedDatabase:e.array(e.string().min(1,o.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedStorage:e.array(e.string().min(1,o.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),connectedMessaging:e.array(e.string().min(1,o.REQUIRED.CONNECTED_RESOURCE_NAME)).optional(),cluster:X.optional(),services:e.array(j).optional(),docker:A.partial().optional(),deployment:e.enum($).optional(),codePath:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(N,o.LAMBDA.TIMEOUT.MAX).optional(),memory:g.optional(),handler:e.string().optional(),runtime:Y.optional(),environment:l.optional(),secrets:l.optional(),eventSources:e.array(v).optional(),functionUrl:e.object({authType:e.enum(D)}).strict().optional(),description:e.string().optional(),scheduleExpression:e.string().optional(),architecture:e.enum(z).optional(),ephemeralStorageSize:e.number().int(o.EPHEMERAL_STORAGE.INTEGER).min(512,o.EPHEMERAL_STORAGE.MIN).max(10240,o.EPHEMERAL_STORAGE.MAX).optional(),functionName:e.string().optional(),ssmSecrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),alarms:re.optional(),instanceType:P.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional(),variableName:e.string().optional(),extraProperties:e.array(E).optional()}).strict().superRefine((n,t)=>{if(n.type==="ecs"&&n.services)for(let i=0;i<n.services.length;i++){const a=n.services[i];a?.ec2Config?.instanceType&&!a.ec2Config.amiHardwareType&&ne(a.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${a.name??i}' uses instance type '${a.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",i,"ec2Config","instanceType"]})}n.type==="lambda"&&n.deployment==="container"&&n.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),_e=e.object({appName:s,clusterName:c,containerPort:T,nameProvidedByFlag:e.boolean().optional(),ecrRepository:e.string().optional(),capacityProvider:y.optional(),useAppEcr:e.boolean().optional(),desiredCount:u.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),minCapacity:G.optional(),maxCapacity:U.optional(),ec2Config:_.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),ye=e.object({appName:s,functionName:c,nameProvidedByFlag:e.boolean().optional(),lambdaType:e.enum(["basic","web","custom"]).optional(),ecrRepository:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(N,o.LAMBDA.TIMEOUT.MAX).optional(),memory:g.optional(),enableFunctionUrl:e.boolean().optional(),description:e.string().optional(),enableCors:e.boolean().optional(),corsOrigins:e.string().optional(),corsHeaders:e.string().optional(),corsMethods:e.array(e.enum(V)).optional(),corsCredentials:e.boolean().optional(),connectionConfig:C.optional()}).strict(),Pe=e.object({appName:s,instanceName:c,nameProvidedByFlag:e.boolean().optional(),instanceType:P.optional(),enableSSH:e.boolean().optional(),minCapacity:G.optional(),maxCapacity:U.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),be=e.object({appName:s,clusterName:c,serviceName:B,capacityProvider:y,containerPort:T.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),ec2Config:_.optional(),routing:e.union([M,e.array(M).min(1)]).optional(),docker:A.partial().optional(),nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),b=e.object({appName:s,computeName:c,nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),le=b.extend({type:e.literal("ecs"),cluster:X.optional(),services:e.array(j).min(1,o.SERVICE.MIN_REQUIRED),docker:A.partial().optional()}).strict().refine(n=>{const t=n.services.filter(i=>i.containers?.some(a=>a.port));return t.length>1?t.every(i=>(Array.isArray(i.routing)?i.routing:i.routing?[i.routing]:[]).some(R=>R.path||R.host)):!0},{message:o.SERVICE.ROUTING_REQUIRED}).refine(n=>{const t=n.services.map(i=>i.name);return new Set(t).size===t.length},{message:o.SERVICE.UNIQUE_WITHIN_CLUSTER}),Ae=b.extend({type:e.literal("lambda"),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(N,o.LAMBDA.TIMEOUT.MAX).optional(),memory:g.optional(),handler:e.string().optional(),runtime:Y.optional(),environment:l.optional(),secrets:l.optional(),description:e.string().optional(),functionUrl:e.union([e.object({authType:e.enum(D).optional()}).strict(),e.literal(!1)]).optional(),eventSources:e.array(v).optional()}).strict(),Ce=b.extend({type:e.literal("ec2"),instanceType:P.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional()}).strict(),he=e.discriminatedUnion("type",[le,Ae,Ce]),k=e.object({path:e.string().min(1,o.REQUIRED.ROUTING_PATH),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional()}).strict(),fe=e.object({name:e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.RESOURCE_NAME,o.RESOURCE_NAME),serviceType:e.enum(H).optional(),docker:A.partial().optional(),containerPort:T.optional(),needsDatabaseConnection:e.boolean().optional(),routing:e.union([k,e.array(k).min(1)]).optional()}).strict().superRefine((n,t)=>{n.serviceType==="worker"&&(n.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),n.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),Oe=e.object({appName:s,instanceType:e.string().optional()}).strict();export{be as AddServiceGeneratorSchema,fe as ApplicationServiceConfigSchema,k as ApplicationServiceRoutingSchema,he as ComputeGeneratorSchema,de as ComputeResourcePlanSchema,me as ComputeTypeSchema,pe as ContainerConfigSchema,Pe as EC2GeneratorSchema,_e as ECSGeneratorSchema,_ as Ec2ConfigSchema,y as EcsCapacityProviderSchema,X as EcsClusterConfigSchema,M as EcsRoutingConfigSchema,Ee as EcsScalingConfigSchema,j as EcsServiceConfigSchema,B as EcsServiceNameSchema,P as InstanceTypeSchema,v as LambdaEventSourceSchema,ye as LambdaGeneratorSchema,g as LambdaMemorySchema,Y as LambdaRuntimeSchema,Oe as TunnelGeneratorSchema,se as WarmPoolSchema};

package/dist/src/validation/validationMessages.d.ts

@@ -40,6 +40,7 @@ export declare const VALIDATION_MESSAGES: Readonly<{
         readonly SUBTYPE: "Subtype is required";
         readonly DEPLOY_TARGET: "Deploy target is required";
         readonly DESTROY_TARGET: "Destroy target is required";
+        readonly CONNECTED_RESOURCE_NAME: "Connected resource names must not be empty";
     };
     readonly MAX_LENGTH: {
         readonly APP_NAME: "Application name must be 50 characters or less";

package/dist/src/validation/validationMessages.js

@@ -1 +1 @@
-import{SECRET_NAME_ERROR as e,SSM_COMPONENT_ERROR as t}from"@fjall/util";const n=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:e,SSM_COMPONENT:t,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});export{n as VALIDATION_MESSAGES};
+import{SECRET_NAME_ERROR as e,SSM_COMPONENT_ERROR as t}from"@fjall/util";const n=Object.freeze({IDENTIFIER:"Must start with a letter, contain only letters, numbers, and hyphens",NEW_APP_NAME:"Must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",IDENTIFIER_MIN_LENGTH:"Must be at least 2 characters",IDENTIFIER_NO_TRAILING_HYPHEN:"Must not end with a hyphen",IDENTIFIER_NO_CONSECUTIVE_HYPHENS:"Must not contain consecutive hyphens",RESOURCE_NAME:"Must start with a letter and contain only letters and numbers (PascalCase recommended)",ECS_SERVICE_NAME:"Service name must start with a letter and contain only letters, numbers, and hyphens",BUCKET_NAME:"Bucket name must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens",DATABASE_NAME:"Database name must start with a letter and contain only letters, numbers, and underscores",RESOURCE_TYPE:"Resource type must be in format 'category' or 'category:type'",SSM_PATH:"SSM path must start with / and contain valid namespace segments (e.g., /myapp/ApiCluster/service)",SECRET_NAME:e,SSM_COMPONENT:t,EMAIL:"Please enter a valid email address",DOMAIN:"Please enter a valid domain (e.g., cms.example.com)",DOCKER_IMAGE:"Invalid Docker image name format",REQUIRED:{APP_NAME:"Application name is required",RESOURCE_NAME:"Resource name is required",BUCKET_NAME:"Bucket name is required",SERVICE_NAME:"Service name is required",NETWORK_NAME:"Network name is required",DATABASE_NAME:"Database name is required",ORGANISATION_NAME:"Organisation name is required",EMAIL:"Email is required",NAME:"Name is required",USERNAME:"Username is required",CONTAINER_NAME:"Container name is required",GROUP:"Group is required",PATTERN_NAME:"Pattern name is required",SOURCE:"Source directory is required",BUILD_COMMAND:"Build command is required",OUTPUT_DIR:"Output directory is required",FORMS_TO:"Forms recipient address is required",ROUTING_PATH:"Routing path is required",RESOURCE_REFERENCE:"Resource reference is required",RESOURCE_TYPE:"Resource type is required",VARIANT:"Variant is required",SUBTYPE:"Subtype is required",DEPLOY_TARGET:"Deploy target is required",DESTROY_TARGET:"Destroy target is required",CONNECTED_RESOURCE_NAME:"Connected resource names must not be empty"},MAX_LENGTH:{APP_NAME:"Application name must be 50 characters or less",RESOURCE_NAME:"Resource name must be 63 characters or less",BUCKET_NAME:"Bucket name must be 63 characters or less",SERVICE_NAME:"Service name must be 255 characters or less",NETWORK_NAME:"Network name must be 50 characters or less",DATABASE_NAME:"Database name must be 63 characters or less",ORGANISATION_NAME:"Organisation name must be 50 characters or less"},PORT:{INTEGER:"Port must be an integer",MIN:"Port must be at least 1",MAX:"Port cannot exceed 65535"},USERNAME:{MAX_LENGTH:"Username cannot exceed 63 characters"},LAMBDA:{MEMORY:{INTEGER:"Lambda memory must be an integer",MIN:"Memory must be at least 128 MB",MAX:"Memory cannot exceed 10240 MB",MULTIPLE:"Memory must be 128 MB or a multiple of 64 MB"},TIMEOUT:{INTEGER:"Timeout must be an integer",MIN:"Timeout must be at least 1 second",MAX:"Timeout cannot exceed 900 seconds"},RUNTIME:"Lambda runtime must contain only letters, digits, dots, underscores, or dashes (e.g. 'NODEJS_20_X' or 'nodejs20.x')"},ENV_VAR_NAME:"Environment variable names must start with a letter or underscore and contain only letters, digits, and underscores",PRIORITY:{INTEGER:"Priority must be an integer",MIN:"Priority must be at least 1",MAX:"Priority cannot exceed 50000"},CAPACITY:{MIN:{INTEGER:"Minimum capacity must be an integer",MIN_0:"Minimum capacity must be at least 0",MIN_1:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 100"},MAX:{INTEGER:"Maximum capacity must be an integer",MIN_0:"Maximum capacity must be at least 0",MIN_1:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 100"},DESIRED:{INTEGER:"Desired count must be an integer",MIN:"Desired count must be at least 0",MAX:"Desired count cannot exceed 100"},WARM_POOL_REQUIRED:"minCapacity 0 requires a warmPool \u2014 without it, new tasks wait 60-90s for a cold instance launch",WARM_POOL:{MIN_SIZE:{INTEGER:"Warm pool minSize must be an integer",MIN:"Warm pool minSize must be at least 0",MAX:"Warm pool minSize cannot exceed 100"},MIN_SIZE_EXCEEDS_MAX_CAPACITY:"warmPool.minSize cannot exceed maxCapacity \u2014 the warm pool cannot hold more instances than the ASG allows"}},MEMORY_LIMIT:{INTEGER:"Memory limit must be an integer",MIN_512:"Memory limit must be at least 512 MiB",MIN_128:"Memory limit must be at least 128 MiB",MAX:"Memory limit cannot exceed 30720 MiB"},DATABASE:{PORT:{INTEGER:"Database port must be an integer",MIN:"Database port must be at least 1024",MAX:"Database port cannot exceed 65535"},NAME:{REQUIRED:"Database name is required",MAX_LENGTH:"Database name must be 63 characters or less"}},BACKUP_RETENTION:{INTEGER:"Backup retention must be an integer",MIN:"Backup retention must be at least 1 day",MAX:"Backup retention cannot exceed 35 days"},SQS:{VISIBILITY_TIMEOUT:{INTEGER:"Visibility timeout must be an integer",MIN:"Visibility timeout must be at least 0 seconds",MAX:"Visibility timeout cannot exceed 43200 seconds (12 hours)"},RETENTION_PERIOD:{INTEGER:"Retention period must be an integer",MIN:"Retention period must be at least 60 seconds",MAX:"Retention period cannot exceed 1209600 seconds (14 days)"}},READER:{COUNT:{INTEGER:"Reader count must be an integer",MIN:"Reader count must be at least 0",MAX:"Reader count cannot exceed 15"}},IDENTIFIER_SUFFIX:{REQUIRED:"Identifier suffix is required when specified",MAX_LENGTH:"Identifier suffix cannot exceed 50 characters"},ROTATION:{INTEGER:"Rotation days must be an integer",MIN:"Rotation interval must be at least 1 day",MAX:"Rotation interval cannot exceed 365 days"},MAX_CONNECTIONS:{INTEGER:"Max connections must be an integer",MIN:"Max connections must be at least 1",MAX:"Max connections cannot exceed 100"},MONITORING_INTERVAL:{INTEGER:"Monitoring interval must be an integer",MIN:"Monitoring interval must be at least 0",MAX:"Monitoring interval cannot exceed 60 seconds",VALUES:"Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds"},RETENTION_DAYS:{INTEGER:"Retention days must be an integer",MIN:"Retention days must be at least 1",MAX:"Retention days cannot exceed 365"},BATCH_SIZE:{INTEGER:"Batch size must be an integer",MIN:"Batch size must be at least 1",MAX:"Batch size cannot exceed 10000"},SERVICE:{UNIQUE_WITHIN_CLUSTER:"Service names must be unique within a cluster",MIN_REQUIRED:"At least one service is required",ROUTING_REQUIRED:"Multiple services with ports require routing config (path or host)"},PROXY_CONFIG:{MAX_IDLE_CONNECTIONS:{INTEGER:"Max idle connections must be an integer",MIN:"Max idle connections must be at least 0",MAX:"Max idle connections cannot exceed 100"},BORROW_TIMEOUT:{INTEGER:"Connection borrow timeout must be an integer",MIN:"Connection borrow timeout must be at least 1 second",MAX:"Connection borrow timeout cannot exceed 3600 seconds"}},MAX_AZS:{INTEGER:"Max AZs must be an integer",MIN:"Max AZs must be at least 1",MAX:"Max AZs cannot exceed 3"},BATCHING_WINDOW:{INTEGER:"Max batching window must be an integer",MIN:"Max batching window must be at least 0",MAX:"Max batching window cannot exceed 300 seconds"},HEALTH_CHECK:{INTERVAL:{INTEGER:"Health check interval must be an integer",MIN:"Health check interval must be at least 5 seconds",MAX:"Health check interval cannot exceed 300 seconds"},TIMEOUT:{INTEGER:"Health check timeout must be an integer",MIN:"Health check timeout must be at least 2 seconds",MAX:"Health check timeout cannot exceed 60 seconds"},RETRIES:{INTEGER:"Health check retries must be an integer",MIN:"Health check retries must be at least 1",MAX:"Health check retries cannot exceed 10"},START_PERIOD:{INTEGER:"Health check start period must be an integer",MIN:"Health check start period must be at least 0 seconds",MAX:"Health check start period cannot exceed 300 seconds"}},EPHEMERAL_STORAGE:{INTEGER:"Ephemeral storage size must be an integer",MIN:"Ephemeral storage size must be at least 512 MB",MAX:"Ephemeral storage size cannot exceed 10240 MB"},MAX_MESSAGE_SIZE:{INTEGER:"Max message size must be an integer",MIN:"Max message size must be at least 1024 bytes",MAX:"Max message size cannot exceed 262144 bytes (256 KB)"},CAPACITY_CONSTRAINT:{MIN_LTE_MAX:"minCapacity must be less than or equal to maxCapacity"},DIRECT_ACCESS:{NO_DOMAIN:"directAccess cannot be used with domain (no ALB for HTTPS)",NO_LOAD_BALANCER:"directAccess cannot be used with loadBalancer (mutually exclusive)"},GLOBAL_AURORA:{PRIMARY_REGION_REQUIRED:"primaryRegion is required for GlobalAurora databases"},NAT_GATEWAY:{INTEGER:"NAT gateway count must be an integer",MIN:"NAT gateway count must be at least 0",MAX:"NAT gateway count cannot exceed 3"},CIDR_MASK:{INTEGER:"CIDR mask must be an integer",MIN:"CIDR mask must be at least 16",MAX:"CIDR mask cannot exceed 28"},CPU:{INTEGER:"CPU must be an integer",MIN:"CPU must be at least 256 units",MAX:"CPU cannot exceed 4096 units"},KMS:{KEY_REQUIRED:"KMS key ARN is required when using KMS encryption"},READER_INSTANCES:{MAX:"Cannot have more than 15 reader instances",COUNT_OR_INSTANCES:"Cannot specify both 'count' and 'instances' - use one or the other"},GENERATOR_CAPACITY:{MIN:{MIN:"Minimum capacity must be at least 1",MAX:"Minimum capacity cannot exceed 1000"},MAX:{MIN:"Maximum capacity must be at least 1",MAX:"Maximum capacity cannot exceed 1000"}},INSTANCE_TYPE:"Unknown instance type. Common types include: t4g.micro, t4g.small, m5.large",ARCHITECTURE_MISMATCH:"Architecture mismatch between instance type and AMI",ALLOCATED_STORAGE:{INTEGER:"Allocated storage must be an integer",MIN:"Allocated storage must be at least 20 GB",MAX:"Allocated storage cannot exceed 65536 GB"},DLQ:{MAX_RECEIVE_COUNT:{INTEGER:"Max receive count must be an integer",MIN:"Max receive count must be at least 1",MAX:"Max receive count cannot exceed 1000"}},ALARM:{PERCENTAGE:{MIN:"Threshold must be at least 1%",MAX:"Threshold must be at most 100%"},FREE_STORAGE_GIB:{MIN:"Free storage threshold must be at least 1 GiB"}},REGION:"Invalid AWS region",PASCAL_CASE:"Resource name must start with an uppercase letter and contain only alphanumerics (PascalCase).",IMAGE_DOCKER_MUTEX:"image and docker are mutually exclusive",AWS_ACCOUNT_ID:"AWS account id must be exactly 12 digits (no hyphens)",VPC_ID:"VPC id must look like vpc-abc12345",ROLE_ARN:"Role ARN must have the form arn:aws:iam::<account-id>:role/<name>",CIDR:"CIDR must be in dotted-quad/prefix-length form (e.g. 10.0.0.0/16)",VPC_PEER:{MIN_REQUESTER_ACCOUNTS:"At least one requester account id is required",REGION_REQUIRED:"Peer region is required when specified",ROUTE_TABLE_ID_REQUIRED:"Route table id must not be empty"},SCHEDULE_EXPRESSION:"Schedule expression must be 'rate(N minute|minutes|hour|hours|day|days)' with N>=1, or 'cron(<6-field AWS expression>)'"});export{n as VALIDATION_MESSAGES};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "14.1.0";
+export declare const GENERATOR_VERSION = "14.2.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="14.1.0";export{E as GENERATOR_VERSION};
+const E="14.2.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "14.1.0",
+  "version": "14.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -57,7 +57,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^14.1.0",
+    "@fjall/util": "^14.2.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",