@fjall/generator 14.2.0 → 14.3.0

package/dist/.build-source-hash

@@ -9,10 +9,10 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "6d028a961afb031d8a02daeffe0311505bf6f29a03a51de748a739742361e8bc",
+  "hash": "c197865438d6a6214248a8902160c0d9169037282836cf9111df93c3bb3f793f",
   "files": {
     "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
-    "src/ast/domain/astDomainParser.ts": "a1f49028bcf3508a",
+    "src/ast/domain/astDomainParser.ts": "54a50bcec75a8306",
     "src/ast/index.ts": "48c73220502e5201",
     "src/ast/mutation/astCodeInjection.ts": "c1ebf483fb1e2332",
     "src/ast/mutation/astExpressionEvaluator.ts": "6082789268b91212",
@@ -37,10 +37,10 @@
     "src/aws/regions.ts": "a028bcb92b0e41d9",
     "src/codemod/_internal.ts": "e865b7172fcc457b",
     "src/codemod/drift/detect.ts": "05f17c36c25a76ad",
-    "src/codemod/drift/index.ts": "e87e1ced35eefa44",
+    "src/codemod/drift/index.ts": "bff894032fd0ae09",
     "src/codemod/drift/merge.ts": "29093929befa9abd",
-    "src/codemod/drift/snapshot.ts": "e389b8dbc41f6dc3",
-    "src/codemod/drift/types.ts": "7f1d7899e420e4d7",
+    "src/codemod/drift/snapshot.ts": "42748d69d1bc5142",
+    "src/codemod/drift/types.ts": "a1d07d77aa48dc17",
     "src/codemod/edits/addResource.ts": "bdc90708af588ff4",
     "src/codemod/edits/addResource/appBinding.ts": "3553fdb30fe06335",
     "src/codemod/edits/addResource/bodyIndex.ts": "3e179eac10d7bcf4",
@@ -77,18 +77,18 @@
     "src/codemod/fileRewriter/parse.ts": "b12026c31562a13c",
     "src/codemod/fileRewriter/print.ts": "f5ff7afb5b7786bf",
     "src/codemod/historyPaths.ts": "ef8084013146db57",
-    "src/codemod/index.ts": "230dbe39a65348ae",
+    "src/codemod/index.ts": "49bf31b304603e50",
     "src/codemod/listResources.ts": "97f206a50edbea20",
     "src/codemod/llmFallback/apply.ts": "2e656a6e55b3b4e3",
     "src/codemod/llmFallback/claudeTier.ts": "ace3e3baa51383c9",
     "src/codemod/llmFallback/egressGate.ts": "1b9076a5c51508fc",
     "src/codemod/llmFallback/egressGate.types.ts": "e30947f12ee546ff",
     "src/codemod/llmFallback/gateFallbackOutput.ts": "c630f3f0215ef077",
-    "src/codemod/llmFallback/index.ts": "d32779fa95df6b94",
+    "src/codemod/llmFallback/index.ts": "b23cd7643ee5db3c",
     "src/codemod/llmFallback/morphTier.ts": "adcc1cf280f9a65d",
     "src/codemod/llmFallback/prompt.ts": "60e8f4ab434bf9ec",
     "src/codemod/llmFallback/runFallback.ts": "03880734d6c456af",
-    "src/codemod/llmFallback/shouldTryFallback.ts": "df6038f97612b8ee",
+    "src/codemod/llmFallback/shouldTryFallback.ts": "0ea7eeabf341f2c9",
     "src/codemod/llmFallback/signals.ts": "298bae6465b5f173",
     "src/codemod/llmFallback/telemetryEvents.ts": "827282cb185eea6c",
     "src/codemod/llmFallback/tierRunner.ts": "a26094accd78cf15",
@@ -114,10 +114,10 @@
     "src/detection/index.ts": "b4ad9a935564cb3e",
     "src/dns/bindParser.ts": "376d274bf9e4bf9f",
     "src/dns/bindWriter.ts": "c296911ce5aef77c",
-    "src/dns/domainFileGenerator.ts": "179258ce9d15d990",
-    "src/dns/domainRecords.ts": "ab917006b92ae916",
+    "src/dns/domainFileGenerator.ts": "cb03cd1a6b1bf452",
+    "src/dns/domainRecords.ts": "912ee83fc9ebdfcf",
     "src/dns/index.ts": "266288ae3b851e3d",
-    "src/dns/tsEmitter.ts": "2f2f13061d1850db",
+    "src/dns/tsEmitter.ts": "1667fe66013e767d",
     "src/dns/types.ts": "82d6db9d7d26dbc2",
     "src/generation/common.ts": "20075ada839797fb",
     "src/generation/compute.ts": "4029a0d8e3197686",
@@ -179,11 +179,11 @@
     "src/validation/patterns.ts": "f9629eafdad7ac3e",
     "src/validation/validationMessages.ts": "772ae6e5a897a301",
     "src/validation/validationPatterns.ts": "865f3d688975b7c8",
-    "src/version.ts": "cbdfef5ce52036bb",
+    "src/version.ts": "f45b030d713c0c00",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "82ab778ab479909c",
+    "package.json": "300a99e3aa568d7d",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "7e48f63d787d3a26a089767f43bc64628be0c727974a63da7119a9fe6be5bb28",
+  "outputHash": "b1a6f9021e616997964204947d103b53edf2f79639e97e05eea0dcb8d79d76cd",
   "outputFileCount": 339
 }

package/dist/.minified

@@ -1 +1 @@
-169 files minified at 2026-08-18T14:33:02.288Z
+169 files minified at 2026-08-20T22:18:56.335Z

package/dist/src/ast/domain/astDomainParser.d.ts

@@ -52,12 +52,16 @@ export interface ParsedStandardRecord {
     readonly name: string;
     readonly value: string | string[];
     readonly ttl?: number;
+    /** Construct-id override (stable-mode collision escape hatch). */
+    readonly id?: string;
 }
 export interface ParsedAliasRecord {
     readonly kind: "alias";
     readonly type: "A" | "AAAA";
     readonly name: string;
     readonly target: ParsedFjallTarget;
+    /** Construct-id override (stable-mode collision escape hatch). */
+    readonly id?: string;
 }
 export type ParsedDnsRecordFromAst = ParsedStandardRecord | ParsedAliasRecord;
 export interface ParsedCertificateFromAst {
@@ -74,6 +78,14 @@ export interface ParsedCertificateFromAst {
 }
 interface ParsedDomainCommon {
     readonly zoneName: string;
+    /**
+     * Records-list construct-id scheme (`DomainCommonProps.recordIds`);
+     * `undefined` means the construct default (`"indexed"`). Parsed
+     * fail-closed: dropping it on a round trip would silently flip a
+     * stable-mode zone back to indexed IDs — a full delete+recreate of its
+     * record sets at the next deploy.
+     */
+    readonly recordIds: "indexed" | "stable" | undefined;
     readonly description: string | undefined;
     readonly costAllocationEnvironment: string | undefined;
     readonly tags: Record<string, string> | undefined;

package/dist/src/ast/domain/astDomainParser.js

@@ -1 +1 @@
-var T=Object.defineProperty;var u=(n,e)=>T(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as $,asString as c,asStringUnion as k,asStringArray as S,asBoolean as b,asNumber as I,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as L}from"../../dns/types.js";import{DomainRegistrarSchema as j,DomainDeployPhaseSchema as O,AliasRecordTypeSchema as Z,TYPED_FJALL_TARGET_KINDS as C}from"../../dns/domainRecords.js";const x=j.options,N=O.options,F=L.options,V=Z.options;function z(n){const e=[],t=u(r=>{if(m.isNewExpression(r)&&P(r.expression)){const o=M(r);o!==void 0&&e.push(o)}m.forEachChild(r,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const i=e[0];return i?l(i):l(void 0)}u(z,"findDomainConstructCall");function P(n){return m.isIdentifier(n)&&n.text==="Domain"}u(P,"isDomainIdentifier");function M(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],i=e[1],r=e[2];if(!t||!i||!r||!m.isObjectLiteralExpression(r))return;const o=q(n);if(o===void 0)return;const d=B(n),s=m.isStringLiteral(i)?i.text:void 0;return{callExpression:n,containingStatement:o,propsObjectLiteral:r,domainVarId:d,scopeArgumentText:t.getText(),constructIdLiteral:s}}u(M,"buildMatch");function q(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(q,"findContainingTopLevelStatement");function B(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(B,"extractDomainVarId");function J(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${x.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(J,"errorMessage");const U="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function G(n){const e=$(n),t=k(e.registrar,x);if(t===void 0){const s=e.registrar;if(s===void 0)return a({kind:"registrar_required"});const f=typeof s=="string"?s:y(s);return a({kind:"registrar_unsupported",value:f})}const i=c(e.zoneName);if(i===void 0)return a({kind:"missing_field",field:"zoneName"});const r=Y(e.records);if(!r.success)return r;const o=W(e.certificates);if(!o.success)return o;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:U});const d={zoneName:i,description:c(e.description),costAllocationEnvironment:c(e.costAllocationEnvironment),tags:X(e.tags),records:r.data,certificates:o.data};switch(t){case"route53":return l({...d,registrar:t,hostedZoneId:c(e.hostedZoneId)});case"external-delegated":{const s=c(e.delegatedSubdomain);if(s===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const f=c(e.hostedZoneId);if(e.hostedZoneId!==void 0&&f===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const h=S(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&h===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(f===void 0!=(h===void 0))return a({kind:"invalid_literal",field:f===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const _=c(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&_===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const A=k(e.phase,N);return e.phase!==void 0&&A===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${N.map(R=>`'${R}'`).join(", ")}`}):l({...d,registrar:t,delegatedSubdomain:s,hostedZoneId:f,adoptedNameServers:h,parentDelegationRoleArn:_,phase:A})}case"external-records":return l({...d,registrar:t})}}u(G,"parseDomainProps");function se(n){return J(n)}u(se,"parseDomainErrorMessage");function oe(n,e,t){const i=m.createSourceFile(e,n,m.ScriptTarget.Latest,!0,m.ScriptKind.TS),r=z(i);if(!r.success)return a(new Error(r.error.message));if(r.data===void 0)return a(new Error(`Domain '${t}': no 'new Domain(...)' call found in ${e} \u2014 the file is not a Fjall domain component.`));const o=G(r.data.propsObjectLiteral);return o.success?l(o.data):a(new Error(`Domain '${t}': infrastructure.ts could not be parsed (${o.error.kind}).`))}u(oe,"parseDomainInfrastructureSource");function Y(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const i=n[t];if(!g(i))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const r=w(i,t);if(!r.success)return r;e.push(r.data)}return l(e)}u(Y,"parseRecordsArray");function w(n,e){const t=c(n.type),i=c(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(i===void 0)return a({kind:"missing_field",field:`records[${e}].name`});if(n.target!==void 0){if(!V.some(f=>f===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=H(n.target);return l({kind:"alias",type:t,name:i,target:s})}if(!F.some(s=>s===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const r=K(n.value);if(r===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const o=I(n.ttl),d={kind:"standard",type:t,name:i,value:r,...o!==void 0?{ttl:o}:{}};return l(d)}u(w,"parseRecord");function K(n){if(n===void 0)return;if(typeof n=="string")return n;const e=S(n);if(e!==void 0)return e}u(K,"parseRecordValue");function H(n){if(E(n))return Q(n);if(g(n)){const e=k(n.kind,C);if(e==="ecs"||e==="cdn"){const t=c(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=c(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=c(n.dnsName),i=c(n.hostedZoneId);if(t!==void 0&&i!==void 0)return{kind:e,dnsName:t,hostedZoneId:i}}}return{kind:"unresolved",sourceText:y(n)}}u(H,"parseTarget");function Q(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const i=t[1],r=t[2]??"",o=D(r);switch(i){case"fjallApp":{const d=p(o,0);if(d===void 0)return{kind:"dynamic",sourceText:e};if(o.length<2)return{kind:"ecs",appName:d};const s=p(o,1);return s===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:d,computeName:s}}case"fjallCdn":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:d}}case"fjallBucket":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:d}}case"aliasTo":{if(o.length>=2){const d=p(o,0),s=p(o,1);return d!==void 0&&s!==void 0?{kind:"custom",dnsName:d,hostedZoneId:s}:{kind:"dynamic",sourceText:e}}if(o.length===1){const d=o[0]?.trim()??"",s=v(d,"dnsName"),f=v(d,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(Q,"resolveCallRefTarget");function D(n){const e=[];let t=0,i=null,r="";for(let d=0;d<n.length;d++){const s=n[d];if(i!==null){if(r+=s,s==="\\"&&d+1<n.length){const f=n[d+1];f!==void 0&&(r+=f,d+=1);continue}s===i&&(i=null);continue}if(s==='"'||s==="'"||s==="`"){i=s,r+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,r+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,r+=s;continue}if(s===","&&t===0){e.push(r.trim()),r="";continue}r+=s}const o=r.trim();return o.length>0&&e.push(o),e}u(D,"splitTopLevelArgs");function p(n,e){const t=n[e];if(t===void 0)return;const i=t.trim();if(i.length<2)return;const r=i[0],o=i[i.length-1];if(r===o&&!(r!=='"'&&r!=="'"&&r!=="`"))return i.slice(1,-1)}u(p,"extractStringLiteralArg");function v(n,e){const t=n.trim().replace(/^\{|\}$/g,""),i=D(t);for(const r of i){const o=r.indexOf(":");if(o<0||r.slice(0,o).trim().replace(/["'`]/g,"")!==e)continue;const s=r.slice(o+1).trim();return p([s],0)}}u(v,"extractObjectFieldString");function W(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const i=n[t];if(typeof i=="string"){e.push({domainName:i});continue}if(!g(i))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const r=c(i.domainName);if(r===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const o=S(i.subjectAlternativeNames),d=b(i.transparencyLogging),s=b(i.cloudFront);if(i.cloudFront!==void 0&&s===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:r,...o!==void 0?{subjectAlternativeNames:o}:{},...d!==void 0?{transparencyLogging:d}:{},...s!==void 0?{cloudFront:s}:{}})}return l(e)}u(W,"parseCertificatesArray");function X(n){if(n===void 0||!g(n))return;const e={};for(const[t,i]of Object.entries(n)){const r=c(i);r!==void 0&&(e[t]=r)}return Object.keys(e).length===0?void 0:e}u(X,"parseStringRecord");function y(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>y(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(y,"stringifyParsedValue");export{z as findDomainConstructCall,se as parseDomainErrorMessage,oe as parseDomainInfrastructureSource,G as parseDomainProps,D as splitTopLevelArgs};
+var T=Object.defineProperty;var u=(n,e)=>T(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as E,asString as f,asStringUnion as h,asStringArray as k,asBoolean as D,asNumber as L,isCallRef as j,isParsedObject as S}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as O}from"../../dns/types.js";import{DomainRegistrarSchema as C,DomainDeployPhaseSchema as Z,AliasRecordTypeSchema as F,RecordConstructIdSchema as V,RecordIdsModeSchema as P,TYPED_FJALL_TARGET_KINDS as z}from"../../dns/domainRecords.js";const N=C.options,x=Z.options,I=P.options,M=O.options,q=F.options;function B(n){const e=[],t=u(r=>{if(m.isNewExpression(r)&&J(r.expression)){const d=U(r);d!==void 0&&e.push(d)}m.forEachChild(r,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const i=e[0];return i?l(i):l(void 0)}u(B,"findDomainConstructCall");function J(n){return m.isIdentifier(n)&&n.text==="Domain"}u(J,"isDomainIdentifier");function U(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],i=e[1],r=e[2];if(!t||!i||!r||!m.isObjectLiteralExpression(r))return;const d=w(n);if(d===void 0)return;const o=G(n),s=m.isStringLiteral(i)?i.text:void 0;return{callExpression:n,containingStatement:d,propsObjectLiteral:r,domainVarId:o,scopeArgumentText:t.getText(),constructIdLiteral:s}}u(U,"buildMatch");function w(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(w,"findContainingTopLevelStatement");function G(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(G,"extractDomainVarId");function Y(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${N.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(Y,"errorMessage");const K="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function H(n){const e=E(n),t=h(e.registrar,N);if(t===void 0){const c=e.registrar;if(c===void 0)return a({kind:"registrar_required"});const p=typeof c=="string"?c:y(c);return a({kind:"registrar_unsupported",value:p})}const i=f(e.zoneName);if(i===void 0)return a({kind:"missing_field",field:"zoneName"});const r=h(e.recordIds,I);if(e.recordIds!==void 0&&r===void 0)return a({kind:"invalid_literal",field:"recordIds",reason:`must be one of ${I.map(c=>`'${c}'`).join(", ")}`});const d=Q(e.records);if(!d.success)return d;const o=te(e.certificates);if(!o.success)return o;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:K});const s={zoneName:i,recordIds:r,description:f(e.description),costAllocationEnvironment:f(e.costAllocationEnvironment),tags:re(e.tags),records:d.data,certificates:o.data};switch(t){case"route53":return l({...s,registrar:t,hostedZoneId:f(e.hostedZoneId)});case"external-delegated":{const c=f(e.delegatedSubdomain);if(c===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const p=f(e.hostedZoneId);if(e.hostedZoneId!==void 0&&p===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const _=k(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&_===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(p===void 0!=(_===void 0))return a({kind:"invalid_literal",field:p===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const A=f(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&A===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const b=h(e.phase,x);return e.phase!==void 0&&b===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${x.map($=>`'${$}'`).join(", ")}`}):l({...s,registrar:t,delegatedSubdomain:c,hostedZoneId:p,adoptedNameServers:_,parentDelegationRoleArn:A,phase:b})}case"external-records":return l({...s,registrar:t})}}u(H,"parseDomainProps");function ue(n){return Y(n)}u(ue,"parseDomainErrorMessage");function ce(n,e,t){const i=m.createSourceFile(e,n,m.ScriptTarget.Latest,!0,m.ScriptKind.TS),r=B(i);if(!r.success)return a(new Error(r.error.message));if(r.data===void 0)return a(new Error(`Domain '${t}': no 'new Domain(...)' call found in ${e} \u2014 the file is not a Fjall domain component.`));const d=H(r.data.propsObjectLiteral);return d.success?l(d.data):a(new Error(`Domain '${t}': infrastructure.ts could not be parsed (${d.error.kind}).`))}u(ce,"parseDomainInfrastructureSource");function Q(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const i=n[t];if(!S(i))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const r=W(i,t);if(!r.success)return r;e.push(r.data)}return l(e)}u(Q,"parseRecordsArray");function W(n,e){const t=f(n.type),i=f(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(i===void 0)return a({kind:"missing_field",field:`records[${e}].name`});const r=f(n.id);if(n.id!==void 0&&(r===void 0||!V.safeParse(r).success))return a({kind:"invalid_literal",field:`records[${e}].id`,reason:"must be a literal alphanumeric string starting with a letter \u2014 it becomes a CloudFormation logical-ID segment"});if(n.target!==void 0){if(!q.some(p=>p===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const c=ee(n.target);return l({kind:"alias",type:t,name:i,target:c,...r!==void 0?{id:r}:{}})}if(!M.some(c=>c===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const d=X(n.value);if(d===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const o=L(n.ttl),s={kind:"standard",type:t,name:i,value:d,...o!==void 0?{ttl:o}:{},...r!==void 0?{id:r}:{}};return l(s)}u(W,"parseRecord");function X(n){if(n===void 0)return;if(typeof n=="string")return n;const e=k(n);if(e!==void 0)return e}u(X,"parseRecordValue");function ee(n){if(j(n))return ne(n);if(S(n)){const e=h(n.kind,z);if(e==="ecs"||e==="cdn"){const t=f(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=f(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=f(n.dnsName),i=f(n.hostedZoneId);if(t!==void 0&&i!==void 0)return{kind:e,dnsName:t,hostedZoneId:i}}}return{kind:"unresolved",sourceText:y(n)}}u(ee,"parseTarget");function ne(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const i=t[1],r=t[2]??"",d=v(r);switch(i){case"fjallApp":{const o=g(d,0);if(o===void 0)return{kind:"dynamic",sourceText:e};if(d.length<2)return{kind:"ecs",appName:o};const s=g(d,1);return s===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:o,computeName:s}}case"fjallCdn":{const o=g(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:o}}case"fjallBucket":{const o=g(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:o}}case"aliasTo":{if(d.length>=2){const o=g(d,0),s=g(d,1);return o!==void 0&&s!==void 0?{kind:"custom",dnsName:o,hostedZoneId:s}:{kind:"dynamic",sourceText:e}}if(d.length===1){const o=d[0]?.trim()??"",s=R(o,"dnsName"),c=R(o,"hostedZoneId");return s!==void 0&&c!==void 0?{kind:"custom",dnsName:s,hostedZoneId:c}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(ne,"resolveCallRefTarget");function v(n){const e=[];let t=0,i=null,r="";for(let o=0;o<n.length;o++){const s=n[o];if(i!==null){if(r+=s,s==="\\"&&o+1<n.length){const c=n[o+1];c!==void 0&&(r+=c,o+=1);continue}s===i&&(i=null);continue}if(s==='"'||s==="'"||s==="`"){i=s,r+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,r+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,r+=s;continue}if(s===","&&t===0){e.push(r.trim()),r="";continue}r+=s}const d=r.trim();return d.length>0&&e.push(d),e}u(v,"splitTopLevelArgs");function g(n,e){const t=n[e];if(t===void 0)return;const i=t.trim();if(i.length<2)return;const r=i[0],d=i[i.length-1];if(r===d&&!(r!=='"'&&r!=="'"&&r!=="`"))return i.slice(1,-1)}u(g,"extractStringLiteralArg");function R(n,e){const t=n.trim().replace(/^\{|\}$/g,""),i=v(t);for(const r of i){const d=r.indexOf(":");if(d<0||r.slice(0,d).trim().replace(/["'`]/g,"")!==e)continue;const s=r.slice(d+1).trim();return g([s],0)}}u(R,"extractObjectFieldString");function te(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const i=n[t];if(typeof i=="string"){e.push({domainName:i});continue}if(!S(i))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const r=f(i.domainName);if(r===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const d=k(i.subjectAlternativeNames),o=D(i.transparencyLogging),s=D(i.cloudFront);if(i.cloudFront!==void 0&&s===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:r,...d!==void 0?{subjectAlternativeNames:d}:{},...o!==void 0?{transparencyLogging:o}:{},...s!==void 0?{cloudFront:s}:{}})}return l(e)}u(te,"parseCertificatesArray");function re(n){if(n===void 0||!S(n))return;const e={};for(const[t,i]of Object.entries(n)){const r=f(i);r!==void 0&&(e[t]=r)}return Object.keys(e).length===0?void 0:e}u(re,"parseStringRecord");function y(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>y(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(y,"stringifyParsedValue");export{B as findDomainConstructCall,ue as parseDomainErrorMessage,ce as parseDomainInfrastructureSource,H as parseDomainProps,v as splitTopLevelArgs};

package/dist/src/codemod/drift/index.d.ts

@@ -1,4 +1,4 @@
 export { detectDrift, type DriftOp, type DriftPlan } from "./detect.js";
 export { mergeProperties, type MergeResult } from "./merge.js";
 export { snapshotProperties } from "./snapshot.js";
-export { DriftPolicySchema, DriftStateSchema, PropertyDeltaSchema, ResourceSnapshotSchema, type DriftPolicy, type DriftState, type PropertyDelta, type ResourceSnapshot, } from "./types.js";
+export { DriftPolicySchema, DriftStateSchema, PropertyDeltaSchema, RESOURCE_SNAPSHOT_SCHEMA_VERSION, ResourceSnapshotSchema, type DriftPolicy, type DriftState, type PropertyDelta, type ResourceSnapshot, } from "./types.js";

package/dist/src/codemod/drift/index.js

@@ -1 +1 @@
-import{detectDrift as t}from"./detect.js";import{mergeProperties as m}from"./merge.js";import{snapshotProperties as a}from"./snapshot.js";import{DriftPolicySchema as f,DriftStateSchema as h,PropertyDeltaSchema as i,ResourceSnapshotSchema as s}from"./types.js";export{f as DriftPolicySchema,h as DriftStateSchema,i as PropertyDeltaSchema,s as ResourceSnapshotSchema,t as detectDrift,m as mergeProperties,a as snapshotProperties};
+import{detectDrift as t}from"./detect.js";import{mergeProperties as S}from"./merge.js";import{snapshotProperties as p}from"./snapshot.js";import{DriftPolicySchema as c,DriftStateSchema as f,PropertyDeltaSchema as h,RESOURCE_SNAPSHOT_SCHEMA_VERSION as i,ResourceSnapshotSchema as s}from"./types.js";export{c as DriftPolicySchema,f as DriftStateSchema,h as PropertyDeltaSchema,i as RESOURCE_SNAPSHOT_SCHEMA_VERSION,s as ResourceSnapshotSchema,t as detectDrift,S as mergeProperties,p as snapshotProperties};

package/dist/src/codemod/drift/snapshot.d.ts

@@ -1,8 +1,40 @@
 import { type Result } from "../../types/Result.js";
 import { type NodeShapeLike, type ObjectExpressionNodeLike } from "../edits/modifyResource/literalConversion.js";
 import type { CodemodError, ResourceName, StatementType } from "../types.js";
-import type { ResourceSnapshot } from "./types.js";
+import { type ResourceSnapshot } from "./types.js";
 export declare function snapshotProperties(content: string, type: StatementType, name: ResourceName): Result<ResourceSnapshot, CodemodError>;
+export interface PlanSpelling {
+    planKey: string;
+    precedence: number;
+}
+export declare const PRECEDENCE_CANONICAL = 2;
+export declare const PRECEDENCE_PLAN_LEAK = 1;
+export declare const PRECEDENCE_ALIAS = 0;
+/**
+ * File-spelling → plan-key map for extraction. Since Increment C the file
+ * speaks construct vocabulary while the plan (and the baseline compared
+ * against it) speaks plan vocabulary, so extraction must recognise a plan
+ * key's construct spelling (`retentionPeriod` is emitted as
+ * `messageRetentionPeriod`) and any declared alias spellings, normalising
+ * every occurrence to the plan spelling — otherwise a hand-edit to a
+ * translated construct key is invisible to drift.
+ *
+ * Claims derive from what the projection can EMIT under a spelling, not from
+ * schema-key identity. A plan key claims its own spelling only if the
+ * projection can emit it under that spelling: a rule without `as`, or a
+ * key/type outside the projection tables (where plan vocabulary is written
+ * verbatim). A planOnly key is NEVER emitted as a construct prop, so it
+ * claims no file spelling at all — its name stays free for a sibling key's
+ * rename target (compute's `ssmSecrets` is emitted as `secrets`, which is
+ * itself a planOnly plan key; the file's `secrets` prop can only ever mean
+ * the SSM array). Precedence encodes what the construct actually reads when
+ * one statement carries several spellings of the same key: canonical
+ * construct spelling beats a plan-vocabulary leak beats a declared alias.
+ *
+ * Exported for the projection-invariant test only; production consumption
+ * goes through {@link snapshotProperties}.
+ */
+export declare function planSpellingsFor(type: StatementType): Map<string, PlanSpelling>;
 /**
  * Resolve the config `ObjectExpression` for a located statement by matching
  * the recast/babel span of the factory call's name `StringLiteral` against

package/dist/src/codemod/drift/snapshot.js

@@ -1 +1 @@
-var h=Object.defineProperty;var u=(r,e)=>h(r,"name",{value:e,configurable:!0});import{failure as f,success as b}from"../../types/Result.js";import{extractProgramBody as g}from"../_internal.js";import{astToLiteral as E,isNodeShape as l,NON_LITERAL as x,readKeyName as k}from"../edits/modifyResource/literalConversion.js";import{visit as N}from"../edits/objectGraph.js";import{parse as O}from"../fileRewriter/index.js";import{listResources as S}from"../listResources.js";import{locateNamesFor as j,STATEMENT_REGISTRY as P}from"../registry.js";function Q(r,e,o){const n=S(r);if(!n.success)return f(n.error);const d=j(e,o),s=n.data.resources.find(t=>t.type===e&&d.includes(t.name));if(s===void 0)return f({kind:"ResourceNotFoundError",type:e,name:o,knownNames:n.data.resources.filter(t=>t.type===e).map(t=>t.name)});const i=O(r,s.filePath);if(!i.success)return f(i.error);const a=g(i.data);if(a===void 0)return f({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const c=T(a,s);if(c===void 0)return f({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const y=new Set(Object.keys(P[e].schemaFragment.shape)),m={};for(const t of c.properties){if(t.type!=="Property"&&t.type!=="ObjectProperty"||t.shorthand===!0||t.computed===!0)continue;const p=k(t.key);p===void 0||!y.has(p)||t.value!==void 0&&(m[p]=v(t.value,r))}return b({type:e,name:o,properties:m,schemaVersion:1})}u(Q,"snapshotProperties");function T(r,e){const o=e.start+e.length;let n;const d=u(s=>{if(n!==void 0||s.type!=="CallExpression")return;const i=s.arguments;if(!Array.isArray(i)||i.length<2)return;const a=i[0];if(!l(a)||a.type!=="StringLiteral"||a.start!==e.start||a.end!==o)return;const c=i[1];l(c)&&c.type==="ObjectExpression"&&(n=c)},"visitor");for(const s of r)if(N(s,d),n!==void 0)break;return n}u(T,"findConfigObject");function v(r,e){const o=E(r);return o!==x?o:R(r,e)}u(v,"extractPropertyValue");function R(r,e){const o=typeof r.start=="number"?r.start:void 0,n=typeof r.end=="number"?r.end:void 0;return{kind:"expression",text:o!==void 0&&n!==void 0&&o<n?e.slice(o,n):""}}u(R,"toExpressionValue");export{T as findConfigObject,Q as snapshotProperties};
+var h=Object.defineProperty;var f=(t,n)=>h(t,"name",{value:n,configurable:!0});import*as x from"recast";import{GENERATOR_VERSION as P}from"../../version.js";import{failure as d,success as b}from"../../types/Result.js";import{extractProgramBody as R}from"../_internal.js";import{astToLiteral as S,isNodeShape as g,NON_LITERAL as A,readKeyName as K}from"../edits/modifyResource/literalConversion.js";import{visit as C}from"../edits/objectGraph.js";import{parse as k}from"../fileRewriter/index.js";import{listResources as T}from"../listResources.js";import{constructKeyAliasesFor as _,isProjectableType as j,TYPE_PROJECTIONS as L}from"../../projection/index.js";import{locateNamesFor as I,STATEMENT_REGISTRY as v}from"../registry.js";import{RESOURCE_SNAPSHOT_SCHEMA_VERSION as F}from"./types.js";function ee(t,n,o){const s=T(t);if(!s.success)return d(s.error);const u=I(n,o),c=s.data.resources.find(i=>i.type===n&&u.includes(i.name));if(c===void 0)return d({kind:"ResourceNotFoundError",type:n,name:o,knownNames:s.data.resources.filter(i=>i.type===n).map(i=>i.name)});const e=k(t,c.filePath);if(!e.success)return d(e.error);const r=R(e.data);if(r===void 0)return d({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const a=D(r,c);if(a===void 0)return d({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const l=w(n),m={},y=new Map;for(const i of a.properties){if(i.type!=="Property"&&i.type!=="ObjectProperty"||i.shorthand===!0||i.computed===!0)continue;const E=K(i.key);if(E===void 0)continue;const p=l.get(E);if(p===void 0||i.value===void 0)continue;const N=y.get(p.planKey);N!==void 0&&N>p.precedence||(y.set(p.planKey,p.precedence),m[p.planKey]=G(i.value,t))}return b({type:n,name:o,properties:m,schemaVersion:F,generatorVersion:P})}f(ee,"snapshotProperties");const O=2,V=1,M=0;function w(t){const n=new Map,o=Object.keys(v[t].schemaFragment.shape),s=j(t)?L[t].keys??{}:{},u=f(e=>s[e]?.kind==="planOnly","isPlanOnly"),c=f(e=>{const r=s[e];return r!==void 0&&"as"in r&&r.as!==void 0?r.as:e},"constructKeyOf");for(const e of o)u(e)||c(e)===e&&n.set(e,{planKey:e,precedence:O});for(const e of o){if(u(e))continue;const r=c(e);r!==e&&(n.has(r)||n.set(r,{planKey:e,precedence:O}))}for(const e of o)u(e)||c(e)!==e&&(n.has(e)||n.set(e,{planKey:e,precedence:V}));for(const[e,r]of Object.entries(_(t))){const a=n.get(e);if(a!==void 0)for(const l of r)n.has(l)||n.set(l,{planKey:a.planKey,precedence:M})}return n}f(w,"planSpellingsFor");function D(t,n){const o=n.start+n.length;let s;const u=f(c=>{if(s!==void 0||c.type!=="CallExpression")return;const e=c.arguments;if(!Array.isArray(e)||e.length<2)return;const r=e[0];if(!g(r)||r.type!=="StringLiteral"||r.start!==n.start||r.end!==o)return;const a=e[1];g(a)&&a.type==="ObjectExpression"&&(s=a)},"visitor");for(const c of t)if(C(c,u),s!==void 0)break;return s}f(D,"findConfigObject");function G(t,n){const o=S(t);return o!==A?o:H(t,n)}f(G,"extractPropertyValue");function H(t,n){try{return{kind:"expression",text:x.prettyPrint(t,{tabWidth:2}).code}}catch{const o=typeof t.start=="number"?t.start:void 0,s=typeof t.end=="number"?t.end:void 0;return{kind:"expression",text:o!==void 0&&s!==void 0&&o<s?n.slice(o,s):""}}}f(H,"toExpressionValue");export{M as PRECEDENCE_ALIAS,O as PRECEDENCE_CANONICAL,V as PRECEDENCE_PLAN_LEAK,D as findConfigObject,w as planSpellingsFor,ee as snapshotProperties};

package/dist/src/codemod/drift/types.d.ts

@@ -2,6 +2,20 @@ import { z } from "zod";
 import { PropertyDeltaSchema } from "../types.js";
 export { DriftPolicySchema, type DriftPolicy } from "../types.js";
 export { PropertyDeltaSchema };
+/**
+ * Version of the baseline snapshot format. Version 2 records FILE truth:
+ * `properties` is `snapshotProperties(...)` of the statement as written —
+ * plan-normalised spelling, snapshot value encoding — never the property set
+ * a command happened to carry, and `generatorVersion` stamps the emitting
+ * `@fjall/generator` so a persisted baseline from another vocabulary era can
+ * be discarded at read time.
+ */
+export declare const RESOURCE_SNAPSHOT_SCHEMA_VERSION = 2;
+/**
+ * Canonical home of the baseline snapshot schema. The CLI baseline store
+ * (`cli/src/operations/codemod/codemodBaselineStore.ts`) consumes THIS
+ * schema — re-export, never redeclare (coupled-discriminated-union rule).
+ */
 export declare const ResourceSnapshotSchema: z.ZodObject<{
     type: z.ZodEnum<{
         storage: "storage";
@@ -19,7 +33,8 @@ export declare const ResourceSnapshotSchema: z.ZodObject<{
     }>;
     name: z.ZodString;
     properties: z.ZodRecord<z.ZodString, z.ZodUnknown>;
-    schemaVersion: z.ZodLiteral<1>;
+    schemaVersion: z.ZodLiteral<2>;
+    generatorVersion: z.ZodString;
 }, z.core.$strict>;
 export declare const DriftStateSchema: z.ZodObject<{
     resource: z.ZodObject<{

package/dist/src/codemod/drift/types.js

@@ -1 +1 @@
-import{z as e}from"zod";import{PropertyDeltaSchema as t,ResourceNameSchema as r,StatementTypeSchema as o}from"../types.js";import{DriftPolicySchema as s}from"../types.js";const m=e.object({type:o,name:r,properties:e.record(e.string(),e.unknown()),schemaVersion:e.literal(1)}).strict(),n=e.object({resource:e.object({type:o,name:r}).strict(),deltas:e.array(t),summary:e.enum(["clean","no-op","drifted-compatible","drifted-conflict","unknown"])}).strict();export{s as DriftPolicySchema,n as DriftStateSchema,t as PropertyDeltaSchema,m as ResourceSnapshotSchema};
+import{z as e}from"zod";import{PropertyDeltaSchema as t,ResourceNameSchema as r,StatementTypeSchema as o}from"../types.js";import{DriftPolicySchema as S}from"../types.js";const c=2,m=e.object({type:o,name:r,properties:e.record(e.string(),e.unknown()),schemaVersion:e.literal(c),generatorVersion:e.string().min(1)}).strict(),i=e.object({resource:e.object({type:o,name:r}).strict(),deltas:e.array(t),summary:e.enum(["clean","no-op","drifted-compatible","drifted-conflict","unknown"])}).strict();export{S as DriftPolicySchema,i as DriftStateSchema,t as PropertyDeltaSchema,c as RESOURCE_SNAPSHOT_SCHEMA_VERSION,m as ResourceSnapshotSchema};

package/dist/src/codemod/index.d.ts

@@ -13,7 +13,7 @@ export { resolveConstructByLiteralProperty, type ConstructResolution, type Const
 export { parse } from "./fileRewriter/parse.js";
 export { CrossPlanConnectionResourcePlanSchema, VpcPeerAccepterResourcePlanSchema, VpcPeerResourcePlanSchema, } from "../schemas/index.js";
 export type { CrossPlanConnectionResourcePlan, VpcPeerAccepterResourcePlan, VpcPeerResourcePlan, } from "../schemas/index.js";
-export { detectDrift, mergeProperties, snapshotProperties, type DriftOp, type DriftPlan, type DriftPolicy, type DriftState, type MergeResult, type PropertyDelta, type ResourceSnapshot, } from "./drift/index.js";
+export { detectDrift, mergeProperties, RESOURCE_SNAPSHOT_SCHEMA_VERSION, ResourceSnapshotSchema, snapshotProperties, type DriftOp, type DriftPlan, type DriftPolicy, type DriftState, type MergeResult, type PropertyDelta, type ResourceSnapshot, } from "./drift/index.js";
 export { computeLinesDelta } from "./_internal.js";
 export { ResourceNameSchema, StatementTypeSchema } from "./types.js";
 export { REGISTERED_STATEMENT_TYPES, STATEMENT_REGISTRY, type StatementTypeEntry, } from "./registry.js";
@@ -22,5 +22,5 @@ export { projectionRefusals } from "./emitProjection.js";
 export { CODEMOD_ERROR_KINDS } from "./telemetry/errorKinds.js";
 export type { CodemodErrorKind } from "./telemetry/errorKinds.js";
 export type { GateId } from "./validationGate/index.js";
-export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, gateFallbackOutput, PARSE_GATE, RUNTIME_GATE, runFallback, shouldTryFallback, UNATTRIBUTED_ORGANISATION, type AnthropicClientProvider, type AnthropicContentBlock, type AnthropicResponse, type EgressStage, type FallbackClients, type FallbackDecision, type FallbackEgressBlockedEvent, type FallbackGuardConfig, type FallbackInput, type FallbackIntent, type FallbackOp, type FallbackOutput, type FallbackTelemetry, type FallbackTelemetryEvent, type GateEventAction, type GateFallbackParams, type MorphClientProvider, type RunFallbackInput, type TelemetrySource, type TriggerReason, } from "./llmFallback/index.js";
+export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, gateFallbackOutput, matchFallbackTrigger, PARSE_GATE, RUNTIME_GATE, runFallback, shouldTryFallback, UNATTRIBUTED_ORGANISATION, type AnthropicClientProvider, type AnthropicContentBlock, type AnthropicResponse, type EgressStage, type FallbackClients, type FallbackDecision, type FallbackEgressBlockedEvent, type FallbackGuardConfig, type FallbackInput, type FallbackIntent, type FallbackOp, type FallbackOutput, type FallbackTelemetry, type FallbackTelemetryEvent, type GateEventAction, type GateFallbackParams, type MorphClientProvider, type RunFallbackInput, type TelemetrySource, type TriggerReason, } from "./llmFallback/index.js";
 export type { AddOptions, CodemodError, CodemodSuccess, ControlFlowClassifierError, DriftConflictError, DriftUnmergeableError, DuplicateResourceError, EditOrchestratorSuccess, InvalidPropertyError, LinesChanged, LlmFallbackRejectedError, LlmFallbackTimeoutError, LlmFallbackTier, LlmFallbackUnsafeInputError, MissingAppInitError, ModifyOptions, NodeLocation, ParseError, PermissionError, ReferenceLocation, ReferencesRemainError, RemoveOptions, ResourceListing, ResourceListingEntry, ResourceName, ResourceNotFoundError, SemanticQueryError, StatementType, TemplateLiteralNameError, } from "./types.js";

package/dist/src/codemod/index.js

@@ -1 +1 @@
-import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as s}from"./edits/appendAccountToStage.js";import{setContainerSecrets as E}from"./edits/setContainerSecrets.js";import{connectResourceToCompute as l}from"./edits/connectResourceToCompute.js";import{addVpcPeer as f,modifyVpcPeer as u,removeVpcPeer as T}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as x,modifyVpcPeerAccepter as P,removeVpcPeerAccepter as S}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as v,modifyCrossPlanConnection as C,removeCrossPlanConnection as N}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as b}from"./edits/driftPolicy.js";import{listResources as y}from"./listResources.js";import{resolveConstructByLiteralProperty as G}from"./semanticIndex/index.js";import{parse as I}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as L,VpcPeerResourcePlanSchema as U}from"../schemas/index.js";import{detectDrift as k,mergeProperties as B,snapshotProperties as M}from"./drift/index.js";import{computeLinesDelta as K}from"./_internal.js";import{ResourceNameSchema as q,StatementTypeSchema as w}from"./types.js";import{REGISTERED_STATEMENT_TYPES as H,STATEMENT_REGISTRY as J}from"./registry.js";import{evaluateEmitGuard as W,UNRESOLVED as X}from"./emitGuard.js";import{projectionRefusals as $}from"./emitProjection.js";import{CODEMOD_ERROR_KINDS as re}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as te,buildFiredEvent as ce,buildGateFailedEvent as pe,buildGatePassedEvent as me,buildRejectedEvent as ae,buildSucceededEvent as se,buildTimeoutEvent as ne,estimateCostUsd as Ee,FALLBACK_EVENTS as de,GATE_EVENTS as le,gateFallbackOutput as ie,PARSE_GATE as fe,RUNTIME_GATE as ue,runFallback as Te,shouldTryFallback as Re,UNATTRIBUTED_ORGANISATION as xe}from"./llmFallback/index.js";export{re as CODEMOD_ERROR_KINDS,F as CrossPlanConnectionResourcePlanSchema,de as FALLBACK_EVENTS,le as GATE_EVENTS,fe as PARSE_GATE,H as REGISTERED_STATEMENT_TYPES,ue as RUNTIME_GATE,q as ResourceNameSchema,J as STATEMENT_REGISTRY,w as StatementTypeSchema,xe as UNATTRIBUTED_ORGANISATION,X as UNRESOLVED,L as VpcPeerAccepterResourcePlanSchema,U as VpcPeerResourcePlanSchema,v as addCrossPlanConnection,o as addResource,f as addVpcPeer,x as addVpcPeerAccepter,s as appendAccountToStage,te as buildEgressBlockedEvent,ce as buildFiredEvent,pe as buildGateFailedEvent,me as buildGatePassedEvent,ae as buildRejectedEvent,se as buildSucceededEvent,ne as buildTimeoutEvent,K as computeLinesDelta,l as connectResourceToCompute,k as detectDrift,Ee as estimateCostUsd,W as evaluateEmitGuard,ie as gateFallbackOutput,y as listResources,B as mergeProperties,C as modifyCrossPlanConnection,m as modifyResource,u as modifyVpcPeer,P as modifyVpcPeerAccepter,I as parse,$ as projectionRefusals,N as removeCrossPlanConnection,c as removeResource,T as removeVpcPeer,S as removeVpcPeerAccepter,G as resolveConstructByLiteralProperty,b as resolveDriftPolicy,Te as runFallback,E as setContainerSecrets,Re as shouldTryFallback,M as snapshotProperties};
+import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as a}from"./edits/modifyResource.js";import{appendAccountToStage as s}from"./edits/appendAccountToStage.js";import{setContainerSecrets as E}from"./edits/setContainerSecrets.js";import{connectResourceToCompute as d}from"./edits/connectResourceToCompute.js";import{addVpcPeer as u,modifyVpcPeer as f,removeVpcPeer as R}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as T,modifyVpcPeerAccepter as P,removeVpcPeerAccepter as x}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as C,modifyCrossPlanConnection as v,removeCrossPlanConnection as N}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as V}from"./edits/driftPolicy.js";import{listResources as h}from"./listResources.js";import{resolveConstructByLiteralProperty as y}from"./semanticIndex/index.js";import{parse as G}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as g,VpcPeerResourcePlanSchema as U}from"../schemas/index.js";import{detectDrift as L,mergeProperties as M,RESOURCE_SNAPSHOT_SCHEMA_VERSION as B,ResourceSnapshotSchema as j,snapshotProperties as H}from"./drift/index.js";import{computeLinesDelta as Y}from"./_internal.js";import{ResourceNameSchema as w,StatementTypeSchema as z}from"./types.js";import{REGISTERED_STATEMENT_TYPES as Q,STATEMENT_REGISTRY as W}from"./registry.js";import{evaluateEmitGuard as Z,UNRESOLVED as $}from"./emitGuard.js";import{projectionRefusals as re}from"./emitProjection.js";import{CODEMOD_ERROR_KINDS as te}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as pe,buildFiredEvent as ae,buildGateFailedEvent as me,buildGatePassedEvent as se,buildRejectedEvent as ne,buildSucceededEvent as Ee,buildTimeoutEvent as le,estimateCostUsd as de,FALLBACK_EVENTS as ie,GATE_EVENTS as ue,gateFallbackOutput as fe,matchFallbackTrigger as Re,PARSE_GATE as Se,RUNTIME_GATE as Te,runFallback as Pe,shouldTryFallback as xe,UNATTRIBUTED_ORGANISATION as Ae}from"./llmFallback/index.js";export{te as CODEMOD_ERROR_KINDS,F as CrossPlanConnectionResourcePlanSchema,ie as FALLBACK_EVENTS,ue as GATE_EVENTS,Se as PARSE_GATE,Q as REGISTERED_STATEMENT_TYPES,B as RESOURCE_SNAPSHOT_SCHEMA_VERSION,Te as RUNTIME_GATE,w as ResourceNameSchema,j as ResourceSnapshotSchema,W as STATEMENT_REGISTRY,z as StatementTypeSchema,Ae as UNATTRIBUTED_ORGANISATION,$ as UNRESOLVED,g as VpcPeerAccepterResourcePlanSchema,U as VpcPeerResourcePlanSchema,C as addCrossPlanConnection,o as addResource,u as addVpcPeer,T as addVpcPeerAccepter,s as appendAccountToStage,pe as buildEgressBlockedEvent,ae as buildFiredEvent,me as buildGateFailedEvent,se as buildGatePassedEvent,ne as buildRejectedEvent,Ee as buildSucceededEvent,le as buildTimeoutEvent,Y as computeLinesDelta,d as connectResourceToCompute,L as detectDrift,de as estimateCostUsd,Z as evaluateEmitGuard,fe as gateFallbackOutput,h as listResources,Re as matchFallbackTrigger,M as mergeProperties,v as modifyCrossPlanConnection,a as modifyResource,f as modifyVpcPeer,P as modifyVpcPeerAccepter,G as parse,re as projectionRefusals,N as removeCrossPlanConnection,c as removeResource,R as removeVpcPeer,x as removeVpcPeerAccepter,y as resolveConstructByLiteralProperty,V as resolveDriftPolicy,Pe as runFallback,E as setContainerSecrets,xe as shouldTryFallback,H as snapshotProperties};

package/dist/src/codemod/llmFallback/index.d.ts

@@ -1,6 +1,6 @@
 export { runFallback, type FallbackClients, type RunFallbackInput, } from "./runFallback.js";
 export { gateFallbackOutput, type GateEventAction, type GateFallbackParams, } from "./gateFallbackOutput.js";
-export { shouldTryFallback, type FallbackDecision, type FallbackGuardConfig, } from "./shouldTryFallback.js";
+export { matchFallbackTrigger, shouldTryFallback, type FallbackDecision, type FallbackGuardConfig, } from "./shouldTryFallback.js";
 export { buildEgressBlockedEvent, buildFiredEvent, buildGateFailedEvent, buildGatePassedEvent, buildRejectedEvent, buildSucceededEvent, buildTimeoutEvent, estimateCostUsd, FALLBACK_EVENTS, GATE_EVENTS, UNATTRIBUTED_ORGANISATION, type FallbackEgressBlockedEvent, type FallbackFiredEvent, type FallbackRejectedEvent, type FallbackSucceededEvent, type FallbackTelemetryEvent, type FallbackTimeoutEvent, type GateFailedEvent, type GatePassedEvent, type TelemetrySource, } from "./telemetryEvents.js";
 export { PARSE_GATE, RUNTIME_GATE } from "./types.js";
 export type { AnthropicClientProvider, AnthropicContentBlock, AnthropicResponse, ApplyResult, EgressStage, FallbackInput, FallbackIntent, FallbackOp, FallbackOutput, FallbackTelemetry, MorphClientProvider, MorphResponse, StrReplaceOp, TriggerReason, } from "./types.js";

package/dist/src/codemod/llmFallback/index.js

@@ -1 +1 @@
-import{runFallback as E}from"./runFallback.js";import{gateFallbackOutput as l}from"./gateFallbackOutput.js";import{shouldTryFallback as r}from"./shouldTryFallback.js";import{buildEgressBlockedEvent as a,buildFiredEvent as T,buildGateFailedEvent as i,buildGatePassedEvent as b,buildRejectedEvent as A,buildSucceededEvent as n,buildTimeoutEvent as s,estimateCostUsd as c,FALLBACK_EVENTS as m,GATE_EVENTS as v,UNATTRIBUTED_ORGANISATION as p}from"./telemetryEvents.js";import{PARSE_GATE as G,RUNTIME_GATE as N}from"./types.js";export{m as FALLBACK_EVENTS,v as GATE_EVENTS,G as PARSE_GATE,N as RUNTIME_GATE,p as UNATTRIBUTED_ORGANISATION,a as buildEgressBlockedEvent,T as buildFiredEvent,i as buildGateFailedEvent,b as buildGatePassedEvent,A as buildRejectedEvent,n as buildSucceededEvent,s as buildTimeoutEvent,c as estimateCostUsd,l as gateFallbackOutput,E as runFallback,r as shouldTryFallback};
+import{runFallback as l}from"./runFallback.js";import{gateFallbackOutput as d}from"./gateFallbackOutput.js";import{matchFallbackTrigger as a,shouldTryFallback as o}from"./shouldTryFallback.js";import{buildEgressBlockedEvent as T,buildFiredEvent as i,buildGateFailedEvent as b,buildGatePassedEvent as c,buildRejectedEvent as A,buildSucceededEvent as m,buildTimeoutEvent as n,estimateCostUsd as s,FALLBACK_EVENTS as v,GATE_EVENTS as F,UNATTRIBUTED_ORGANISATION as p}from"./telemetryEvents.js";import{PARSE_GATE as N,RUNTIME_GATE as f}from"./types.js";export{v as FALLBACK_EVENTS,F as GATE_EVENTS,N as PARSE_GATE,f as RUNTIME_GATE,p as UNATTRIBUTED_ORGANISATION,T as buildEgressBlockedEvent,i as buildFiredEvent,b as buildGateFailedEvent,c as buildGatePassedEvent,A as buildRejectedEvent,m as buildSucceededEvent,n as buildTimeoutEvent,s as estimateCostUsd,d as gateFallbackOutput,a as matchFallbackTrigger,l as runFallback,o as shouldTryFallback};

package/dist/src/codemod/llmFallback/shouldTryFallback.d.ts

@@ -11,3 +11,12 @@ export type FallbackDecision = {
     shouldTry: false;
 };
 export declare function shouldTryFallback(error: CodemodError, config: FallbackGuardConfig): FallbackDecision;
+/**
+ * The trigger kind a failure would fall back under, or undefined when no
+ * amount of enablement could make the fallback attempt it.
+ *
+ * Pure and local — no config, no I/O. Consumers whose enablement lookup costs
+ * something (the CLI reads org config over the network) ask this first, so a
+ * failure the fallback can never handle stays free.
+ */
+export declare function matchFallbackTrigger(error: CodemodError): TriggerReason | undefined;

package/dist/src/codemod/llmFallback/shouldTryFallback.js

@@ -1 +1 @@
-var o=Object.defineProperty;var n=(r,e)=>o(r,"name",{value:e,configurable:!0});const t={shouldTry:!1};function i(r,e){if(!e.envEnabled||!e.orgAllowsFallback)return t;const l=u(r);return l===void 0?t:{shouldTry:!0,trigger:l}}n(i,"shouldTryFallback");function u(r){switch(r.kind){case"TemplateLiteralNameError":return"template-literal-name";case"ResourceNotFoundError":return"resource-not-found";case"ControlFlowClassifierError":return r.reason==="anonymous-helper"?"control-flow-unclassifiable":void 0;case"DriftUnmergeableError":return"drift-unmergeable";default:return}}n(u,"matchTrigger");export{i as shouldTryFallback};
+var o=Object.defineProperty;var n=(r,e)=>o(r,"name",{value:e,configurable:!0});const t={shouldTry:!1};function i(r,e){if(!e.envEnabled||!e.orgAllowsFallback)return t;const l=a(r);return l===void 0?t:{shouldTry:!0,trigger:l}}n(i,"shouldTryFallback");function a(r){switch(r.kind){case"TemplateLiteralNameError":return"template-literal-name";case"ResourceNotFoundError":return"resource-not-found";case"ControlFlowClassifierError":return r.reason==="anonymous-helper"?"control-flow-unclassifiable":void 0;case"DriftUnmergeableError":return"drift-unmergeable";default:return}}n(a,"matchFallbackTrigger");export{a as matchFallbackTrigger,i as shouldTryFallback};

package/dist/src/dns/domainFileGenerator.js

@@ -1,4 +1,4 @@
-var p=Object.defineProperty;var o=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as g}from"@fjall/util";import{toPascalCase as w}from"../generation/common.js";import{GENERATOR_VERSION as d}from"../version.js";function I(t){const{domainName:e,hostedZoneId:r,records:n=[]}=t,a=t.basePath??`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:h({domainName:e,records:n,hostedZoneId:r})},{path:`${a}/package.json`,content:f(e)},{path:`${a}/tsconfig.json`,content:y},{path:`${a}/cdk.json`,content:N},{path:`${a}/cdk.context.json`,content:S},{path:`${a}/.gitignore`,content:k}]}o(I,"generateDomainFiles");function h(t){const{domainName:e,records:r,hostedZoneId:n}=t,a=w(e.split(".").join("")),i=g(e),c=r.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),l=c.length>0?`[
+var p=Object.defineProperty;var o=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as g}from"@fjall/util";import{toPascalCase as h}from"../generation/common.js";import{GENERATOR_VERSION as d}from"../version.js";function I(t){const{domainName:e,hostedZoneId:r,records:n=[]}=t,a=t.basePath??`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:w({domainName:e,records:n,hostedZoneId:r})},{path:`${a}/package.json`,content:f(e)},{path:`${a}/tsconfig.json`,content:y},{path:`${a}/cdk.json`,content:N},{path:`${a}/cdk.context.json`,content:S},{path:`${a}/.gitignore`,content:k}]}o(I,"generateDomainFiles");function w(t){const{domainName:e,records:r,hostedZoneId:n}=t,a=h(e.split(".").join("")),i=g(e),c=r.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),l=c.length>0?`[
 ${c.join(`
 `)}
   ]`:"[]",u=n?`  hostedZoneId: ${JSON.stringify(n)},
@@ -19,7 +19,12 @@ const stack = app.getStack(${JSON.stringify(i)}).getStack();
 new Domain(stack, ${JSON.stringify(a)}, {
   registrar: "route53",
   zoneName: ${JSON.stringify(e)},
-${u}  certificates: [
+${u}  // Position-independent record logical IDs (fresh-zone default): records
+  // can be inserted, removed, or reordered freely. Never remove this line
+  // once the zone has deployed \u2014 flipping the mode renames every record's
+  // logical ID (a deliberate two-deploy migration, never a casual edit).
+  recordIds: "stable",
+  certificates: [
     { domainName: ${JSON.stringify(e)} },
     // Serving this zone through CloudFront (staticsite/cdn)? Add a viewer
     // certificate with cloudFront: true \u2014 it is minted in us-east-1 (the
@@ -39,7 +44,7 @@ ${u}  certificates: [
 // and adoptedNameServers (both together) on the child Domain \u2014 the literals
 // feed the parent NS UPSERT because an imported zone exposes no name-server
 // attribute at synth.
-`}o(h,"generateDefaultInfrastructureTs");function f(t){return`{
+`}o(w,"generateDefaultInfrastructureTs");function f(t){return`{
   "name": ${JSON.stringify(`domain-${t}`)},
   "version": "${d}",
   "type": "module",

package/dist/src/dns/domainRecords.d.ts

@@ -40,6 +40,14 @@ export declare const DomainDeployPhaseSchema: z.ZodEnum<{
     full: "full";
 }>;
 export type DomainDeployPhase = z.infer<typeof DomainDeployPhaseSchema>;
+/**
+ * Per-record construct-id override (`recordIds: "stable"` collision escape
+ * hatch) — mirrors `StandardRecord.id` / `AliasRecord.id` in
+ * @fjall/components-infrastructure, which validates the same shape (it
+ * becomes a CloudFormation logical-ID segment).
+ */
+export declare const RecordConstructIdSchema: z.ZodString;
+export type RecordConstructId = z.infer<typeof RecordConstructIdSchema>;
 export declare const ParsedStandardRecordSchema: z.ZodObject<{
     kind: z.ZodLiteral<"standard">;
     type: z.ZodEnum<{
@@ -55,6 +63,7 @@ export declare const ParsedStandardRecordSchema: z.ZodObject<{
     name: z.ZodString;
     value: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     ttl: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const ParsedAliasRecordSchema: z.ZodObject<{
     kind: z.ZodLiteral<"alias">;
@@ -78,6 +87,7 @@ export declare const ParsedAliasRecordSchema: z.ZodObject<{
         dnsName: z.ZodString;
         hostedZoneId: z.ZodString;
     }, z.core.$strict>], "kind">;
+    id: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export declare const ParsedDnsRecordSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"standard">;
@@ -94,6 +104,7 @@ export declare const ParsedDnsRecordSchema: z.ZodDiscriminatedUnion<[z.ZodObject
     name: z.ZodString;
     value: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
     ttl: z.ZodOptional<z.ZodNumber>;
+    id: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"alias">;
     type: z.ZodEnum<{
@@ -116,6 +127,7 @@ export declare const ParsedDnsRecordSchema: z.ZodDiscriminatedUnion<[z.ZodObject
         dnsName: z.ZodString;
         hostedZoneId: z.ZodString;
     }, z.core.$strict>], "kind">;
+    id: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>], "kind">;
 export declare const ParsedCertificateSchema: z.ZodObject<{
     domainName: z.ZodString;
@@ -128,6 +140,18 @@ export declare const ParsedSubdomainDelegationSchema: z.ZodObject<{
     toAccount: z.ZodString;
     auto: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
+/**
+ * Construct-id scheme for the records list — mirrors
+ * `DomainCommonProps.recordIds`. `"stable"` derives position-independent
+ * logical IDs (records can be inserted/removed/reordered freely);
+ * `"indexed"`/absent is the legacy position-coupled formula (append-only
+ * lists, byte-frozen for deployed stacks). Fresh imports emit `"stable"`.
+ */
+export declare const RecordIdsModeSchema: z.ZodEnum<{
+    stable: "stable";
+    indexed: "indexed";
+}>;
+export type RecordIdsMode = z.infer<typeof RecordIdsModeSchema>;
 export declare const ParsedDomainRecordsSchema: z.ZodObject<{
     zoneName: z.ZodString;
     registrar: z.ZodEnum<{
@@ -135,6 +159,10 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
         "external-delegated": "external-delegated";
         "external-records": "external-records";
     }>;
+    recordIds: z.ZodOptional<z.ZodEnum<{
+        stable: "stable";
+        indexed: "indexed";
+    }>>;
     hostedZoneId: z.ZodOptional<z.ZodString>;
     delegatedSubdomain: z.ZodOptional<z.ZodString>;
     adoptedNameServers: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -153,6 +181,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
         name: z.ZodString;
         value: z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>;
         ttl: z.ZodOptional<z.ZodNumber>;
+        id: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"alias">;
         type: z.ZodEnum<{
@@ -175,6 +204,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
             dnsName: z.ZodString;
             hostedZoneId: z.ZodString;
         }, z.core.$strict>], "kind">;
+        id: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>], "kind">>;
     certificates: z.ZodArray<z.ZodObject<{
         domainName: z.ZodString;

package/dist/src/dns/domainRecords.js

@@ -1 +1 @@
-import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string(),computeName:e.string().min(1).optional()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),o=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),i=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[o,i]),d=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),c=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(s),certificates:e.array(d),delegations:e.array(c)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,i as ParsedAliasRecordSchema,d as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,o as ParsedStandardRecordSchema,c as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};
+import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string(),computeName:e.string().min(1).optional()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),p=r.options.map(t=>t.shape.kind.value),n=e.enum(["A","AAAA"]),o=e.enum(["route53","external-delegated","external-records"]),u=e.enum(["zone","full"]),a=e.string().regex(/^[A-Za-z][A-Za-z0-9]*$/),i=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional(),id:a.optional()}).strict(),s=e.object({kind:e.literal("alias"),type:n,name:e.string(),target:r,id:a.optional()}).strict(),d=e.discriminatedUnion("kind",[i,s]),c=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),l=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),m=e.enum(["indexed","stable"]),x=e.object({zoneName:e.string(),registrar:o,recordIds:m.optional(),hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(d),certificates:e.array(c),delegations:e.array(l)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{n as AliasRecordTypeSchema,u as DomainDeployPhaseSchema,o as DomainRegistrarSchema,s as ParsedAliasRecordSchema,c as ParsedCertificateSchema,d as ParsedDnsRecordSchema,x as ParsedDomainRecordsSchema,i as ParsedStandardRecordSchema,l as ParsedSubdomainDelegationSchema,a as RecordConstructIdSchema,m as RecordIdsModeSchema,p as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};

package/dist/src/dns/tsEmitter.js

@@ -1,14 +1,14 @@
-var A=Object.defineProperty;var o=(e,n)=>A(e,"name",{value:n,configurable:!0});import{getDomainStackName as k,toPascalCase as D}from"@fjall/util";const O=["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"],b=new Map(O.map((e,n)=>[e,n]));function C(e,n){return e==="@"&&n!=="@"?-1:e!=="@"&&n==="@"?1:e.localeCompare(n)}o(C,"compareName");function J(e,n){const t=Array.isArray(e)?e.join(`
-`):e,a=Array.isArray(n)?n.join(`
-`):n;return t.localeCompare(a)}o(J,"compareValue");function p(e){const n=e.kind==="standard"?0:1,t=b.get(e.type)??99;return[n,t,e.name]}o(p,"recordSortKey");function R(e){return[...e].sort((n,t)=>{const[a,c,m]=p(n),[s,d,f]=p(t);if(a!==s)return a-s;if(c!==d)return c-d;const u=C(m,f);return u!==0?u:n.kind==="standard"&&t.kind==="standard"?J(n.value,t.value):0})}o(R,"sortRecords");function P(e){return Array.isArray(e)?`[${e.map(t=>JSON.stringify(t)).join(", ")}]`:JSON.stringify(e)}o(P,"formatValue");function v(e){const n=[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`,`value: ${P(e.value)}`];return e.ttl!==void 0&&n.push(`ttl: ${e.ttl}`),`{ ${n.join(", ")} }`}o(v,"emitStandardRecord");function I(e){switch(e.kind){case"ecs":return e.computeName===void 0?`fjallApp(${JSON.stringify(e.appName)})`:`fjallApp(${JSON.stringify(e.appName)}, ${JSON.stringify(e.computeName)})`;case"cdn":return`fjallCdn(${JSON.stringify(e.appName)})`;case"bucket":return`fjallBucket(${JSON.stringify(e.bucketName)})`;case"custom":return`aliasTo(${JSON.stringify(e.dnsName)}, ${JSON.stringify(e.hostedZoneId)})`}}o(I,"emitAliasTarget");function x(e){return`{ ${[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`,`target: ${I(e.target)}`].join(", ")} }`}o(x,"emitAliasRecord");function T(e){return e.kind==="standard"?v(e):x(e)}o(T,"emitRecordObjectText");function w(e){return`    ${T(e)},`}o(w,"emitRecord");function z(e){const n=[`domainName: ${JSON.stringify(e.domainName)}`];if(e.subjectAlternativeNames&&e.subjectAlternativeNames.length>0){const t=e.subjectAlternativeNames.map(a=>JSON.stringify(a)).join(", ");n.push(`subjectAlternativeNames: [${t}]`)}return e.transparencyLogging!==void 0&&n.push(`transparencyLogging: ${e.transparencyLogging}`),e.cloudFront!==void 0&&n.push(`cloudFront: ${e.cloudFront}`),`    { ${n.join(", ")} },`}o(z,"emitCertificate");function B(e,n){if(n.length===0)return"";const t=["","// Delegations (D8 \u2014 child writes NS; no parent-side records here):"];for(const a of n)t.push(`//   ${a.subdomain}.${e} \u2192 deploy a Domain { registrar: "external-delegated",`,`//     zoneName: ${JSON.stringify(e)}, delegatedSubdomain: ${JSON.stringify(a.subdomain)} }`,`//     in account ${JSON.stringify(a.toAccount)}; the CLI injects parentDelegationRoleArn`,"//     (ManagedDomainBinding.delegationRoleArn) and the child UPSERTs its NS into this zone.");return t.join(`
+var A=Object.defineProperty;var o=(e,n)=>A(e,"name",{value:n,configurable:!0});import{getDomainStackName as k,toPascalCase as D}from"@fjall/util";const O=["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"],J=new Map(O.map((e,n)=>[e,n]));function b(e,n){return e==="@"&&n!=="@"?-1:e!=="@"&&n==="@"?1:e.localeCompare(n)}o(b,"compareName");function C(e,n){const t=Array.isArray(e)?e.join(`
+`):e,i=Array.isArray(n)?n.join(`
+`):n;return t.localeCompare(i)}o(C,"compareValue");function p(e){const n=e.kind==="standard"?0:1,t=J.get(e.type)??99;return[n,t,e.name]}o(p,"recordSortKey");function R(e){return[...e].sort((n,t)=>{const[i,c,f]=p(n),[s,d,m]=p(t);if(i!==s)return i-s;if(c!==d)return c-d;const u=b(f,m);return u!==0?u:n.kind==="standard"&&t.kind==="standard"?C(n.value,t.value):0})}o(R,"sortRecords");function I(e){return Array.isArray(e)?`[${e.map(t=>JSON.stringify(t)).join(", ")}]`:JSON.stringify(e)}o(I,"formatValue");function P(e){const n=[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`];return e.id!==void 0&&n.push(`id: ${JSON.stringify(e.id)}`),n.push(`value: ${I(e.value)}`),e.ttl!==void 0&&n.push(`ttl: ${e.ttl}`),`{ ${n.join(", ")} }`}o(P,"emitStandardRecord");function v(e){switch(e.kind){case"ecs":return e.computeName===void 0?`fjallApp(${JSON.stringify(e.appName)})`:`fjallApp(${JSON.stringify(e.appName)}, ${JSON.stringify(e.computeName)})`;case"cdn":return`fjallCdn(${JSON.stringify(e.appName)})`;case"bucket":return`fjallBucket(${JSON.stringify(e.bucketName)})`;case"custom":return`aliasTo(${JSON.stringify(e.dnsName)}, ${JSON.stringify(e.hostedZoneId)})`}}o(v,"emitAliasTarget");function x(e){const n=[`type: ${JSON.stringify(e.type)}`,`name: ${JSON.stringify(e.name)}`];return e.id!==void 0&&n.push(`id: ${JSON.stringify(e.id)}`),n.push(`target: ${v(e.target)}`),`{ ${n.join(", ")} }`}o(x,"emitAliasRecord");function T(e){return e.kind==="standard"?P(e):x(e)}o(T,"emitRecordObjectText");function w(e){return`    ${T(e)},`}o(w,"emitRecord");function z(e){const n=[`domainName: ${JSON.stringify(e.domainName)}`];if(e.subjectAlternativeNames&&e.subjectAlternativeNames.length>0){const t=e.subjectAlternativeNames.map(i=>JSON.stringify(i)).join(", ");n.push(`subjectAlternativeNames: [${t}]`)}return e.transparencyLogging!==void 0&&n.push(`transparencyLogging: ${e.transparencyLogging}`),e.cloudFront!==void 0&&n.push(`cloudFront: ${e.cloudFront}`),`    { ${n.join(", ")} },`}o(z,"emitCertificate");function B(e,n){if(n.length===0)return"";const t=["","// Delegations (D8 \u2014 child writes NS; no parent-side records here):"];for(const i of n)t.push(`//   ${i.subdomain}.${e} \u2192 deploy a Domain { registrar: "external-delegated",`,`//     zoneName: ${JSON.stringify(e)}, delegatedSubdomain: ${JSON.stringify(i.subdomain)} }`,`//     in account ${JSON.stringify(i.toAccount)}; the CLI injects parentDelegationRoleArn`,"//     (ManagedDomainBinding.delegationRoleArn) and the child UPSERTs its NS into this zone.");return t.join(`
 `)+`
 `}o(B,"emitDelegationGuidance");function F(e){const n={fjallApp:!1,fjallCdn:!1,fjallBucket:!1,aliasTo:!1};for(const t of e)if(t.kind==="alias")switch(t.target.kind){case"ecs":n.fjallApp=!0;break;case"cdn":n.fjallCdn=!0;break;case"bucket":n.fjallBucket=!0;break;case"custom":n.aliasTo=!0;break}return n}o(F,"computeUsedHelpers");function L(e){const n=["App","Domain"];return e.aliasTo&&n.push("aliasTo"),e.fjallApp&&n.push("fjallApp"),e.fjallBucket&&n.push("fjallBucket"),e.fjallCdn&&n.push("fjallCdn"),`import {
-${n.map(a=>`  ${a},`).join(`
+${n.map(i=>`  ${i},`).join(`
 `)}
-} from "@fjall/components-infrastructure";`}o(L,"emitImports");function E(e){return D(e.split(".").join(""))}o(E,"safeZoneName");function g(e,n){if(e==="@")return e;const t=e.endsWith(".")?e.slice(0,-1):e;return t===n?"@":t.endsWith(`.${n}`)?t.slice(0,-(n.length+1)):e}o(g,"toRelativeRecordName");function Z(e){return e.registrar==="external-delegated"&&e.delegatedSubdomain?`${e.delegatedSubdomain}.${e.zoneName}`:e.zoneName}o(Z,"effectiveZoneName");function y(e,n,t){if(n.length===0)return`  ${e}: [],`;const a=n.map(t).join(`
+} from "@fjall/components-infrastructure";`}o(L,"emitImports");function E(e){return D(e.split(".").join(""))}o(E,"safeZoneName");function g(e,n){if(e==="@")return e;const t=e.endsWith(".")?e.slice(0,-1):e;return t===n?"@":t.endsWith(`.${n}`)?t.slice(0,-(n.length+1)):e}o(g,"toRelativeRecordName");function Z(e){return e.registrar==="external-delegated"&&e.delegatedSubdomain?`${e.delegatedSubdomain}.${e.zoneName}`:e.zoneName}o(Z,"effectiveZoneName");function y(e,n,t){if(n.length===0)return`  ${e}: [],`;const i=n.map(t).join(`
 `);return`  ${e}: [
-${a}
-  ],`}o(y,"emitBlock");function K(e,n={}){const t=k(n.componentName??e.zoneName),a=E(e.zoneName),c=F(e.records),m=L(c),s=Z(e),d=e.records.map(i=>i.kind==="standard"?{...i,name:g(i.name,s)}:{...i,name:g(i.name,s)}),f=R(d),u=[...e.certificates].sort((i,l)=>i.domainName.localeCompare(l.domainName)),h=[...e.delegations].sort((i,l)=>i.subdomain.localeCompare(l.subdomain)),r=[];if(e.hostedZoneId&&r.push(`  hostedZoneId: ${JSON.stringify(e.hostedZoneId)},`),e.adoptedNameServers&&e.adoptedNameServers.length>0){const i=e.adoptedNameServers.map(l=>JSON.stringify(l)).join(", ");r.push(`  adoptedNameServers: [${i}],`)}e.delegatedSubdomain&&r.push(`  delegatedSubdomain: ${JSON.stringify(e.delegatedSubdomain)},`),e.registrar==="external-delegated"&&r.push("  // D8 child-writes delegation + two-phase deploy: both values arrive","  // via CDK context, injected by the Fjall CLI at deploy time (see the","  // reads above `new Domain`). Set a literal parentDelegationRoleArn","  // here only for out-of-band deploys.",'  ...(domainDeployPhase === "zone" || domainDeployPhase === "full"',"    ? { phase: domainDeployPhase }","    : {}),",'  ...(typeof parentDelegationRoleArn === "string" &&','  parentDelegationRoleArn !== ""',"    ? { parentDelegationRoleArn }","    : {}),");const N=y("certificates",u,z),S=y("records",f,w),$=e.registrar==="external-records"?"":B(e.zoneName,h),j=e.registrar==="external-delegated"?`
+${i}
+  ],`}o(y,"emitBlock");function K(e,n={}){const t=k(n.componentName??e.zoneName),i=E(n.componentName??e.zoneName),c=F(e.records),f=L(c),s=Z(e),d=e.records.map(a=>a.kind==="standard"?{...a,name:g(a.name,s)}:{...a,name:g(a.name,s)}),m=R(d),u=[...e.certificates].sort((a,l)=>a.domainName.localeCompare(l.domainName)),h=[...e.delegations].sort((a,l)=>a.subdomain.localeCompare(l.subdomain)),r=[];if(e.recordIds!==void 0&&r.push(`  recordIds: ${JSON.stringify(e.recordIds)},`),e.hostedZoneId&&r.push(`  hostedZoneId: ${JSON.stringify(e.hostedZoneId)},`),e.adoptedNameServers&&e.adoptedNameServers.length>0){const a=e.adoptedNameServers.map(l=>JSON.stringify(l)).join(", ");r.push(`  adoptedNameServers: [${a}],`)}e.delegatedSubdomain&&r.push(`  delegatedSubdomain: ${JSON.stringify(e.delegatedSubdomain)},`),e.registrar==="external-delegated"&&r.push("  // D8 child-writes delegation + two-phase deploy: both values arrive","  // via CDK context, injected by the Fjall CLI at deploy time (see the","  // reads above `new Domain`). Set a literal parentDelegationRoleArn","  // here only for out-of-band deploys.",'  ...(domainDeployPhase === "zone" || domainDeployPhase === "full"',"    ? { phase: domainDeployPhase }","    : {}),",'  ...(typeof parentDelegationRoleArn === "string" &&','  parentDelegationRoleArn !== ""',"    ? { parentDelegationRoleArn }","    : {}),");const N=y("certificates",u,z),S=y("records",m,w),$=e.registrar==="external-records"?"":B(e.zoneName,h),j=e.registrar==="external-delegated"?`
 // Injected by the Fjall CLI at deploy time (D8) \u2014 do not set these by hand.
 const domainDeployPhase: unknown = app.node.tryGetContext(
   "fjall:domainDeployPhase"
@@ -25,7 +25,7 @@ if (
 const parentDelegationRoleArn: unknown = app.node.tryGetContext(
   "fjall:parentDelegationRoleArn"
 );
-`:"";return`${m}
+`:"";return`${f}
 
 // Fjall-managed domain \u2014 edit this file to add or change records. See https://docs.fjall.io/resources/networking/domain for the Domain construct API.
 
@@ -35,7 +35,7 @@ const app = App.getApp(${JSON.stringify(t)});
 // CloudFormation stack name. Do not rename it.
 const stack = app.getStack(${JSON.stringify(t)}).getStack();
 ${j}
-new Domain(stack, ${JSON.stringify(a)}, {
+new Domain(stack, ${JSON.stringify(i)}, {
   registrar: ${JSON.stringify(e.registrar)},
   zoneName: ${JSON.stringify(e.zoneName)},
 ${r.length>0?r.join(`

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "14.2.0";
+export declare const GENERATOR_VERSION = "14.3.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="14.2.0";export{E as GENERATOR_VERSION};
+const E="14.3.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "14.2.0",
+  "version": "14.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -57,7 +57,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^14.2.0",
+    "@fjall/util": "^14.3.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",