@fjall/generator 2.15.0 → 2.16.0

package/dist/.minified

@@ -1 +1 @@
-138 files minified at 2026-06-12T02:44:59.912Z
+139 files minified at 2026-06-14T08:04:20.305Z

package/dist/src/ast/astTestHelpers.d.ts

@@ -109,6 +109,14 @@ export declare function parseAndConvert(code: string): {
             } | undefined;
         } | undefined;
         retain?: boolean | undefined;
+        resourcePolicyStatements?: {
+            effect: "Allow" | "Deny";
+            principals: string[];
+            actions: string[];
+            sid?: string | undefined;
+            resources?: string[] | undefined;
+            conditions?: Record<string, Record<string, string | string[]>> | undefined;
+        }[] | undefined;
         stackPlacement?: "storage" | "compute" | "cdn" | undefined;
         variableName?: string | undefined;
         extraProperties?: {

package/dist/src/aws/regions.d.ts

@@ -1,5 +1,5 @@
 import { type RegionInfo } from "@fjall/util";
-export { AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, regions, suggestRegionForTimezone, type RegionCode, type RegionInfo, } from "@fjall/util";
+export { AWS_REGIONS_METADATA, DEFAULT_REGION, getRegionInfo, OPT_IN_REGION_CODES, optInRegionWarning, regions, suggestRegionForTimezone, type RegionCode, type RegionInfo, } from "@fjall/util";
 export declare const topRegions: readonly RegionInfo[];
 export declare const commonRegions: readonly ["us-east-2", "us-west-2", "us-east-1", "eu-west-1", "ap-southeast-1"];
 export declare function parseRegionList(value: string): string[];

package/dist/src/aws/regions.js

@@ -1 +1 @@
-import{AWS_REGIONS_METADATA as s,getRegionInfo as f,regions as c}from"@fjall/util";import{AWS_REGIONS_METADATA as y,DEFAULT_REGION as S,getRegionInfo as $,regions as z,suggestRegionForTimezone as D}from"@fjall/util";const g=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],O=Object.freeze(g.flatMap(t=>{const e=f(t);return e?[e]:[]})),u=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function a(t){return t?t.split(",").map(e=>e.trim()).filter(Boolean):[]}function p(t){return c.includes(t)}function l(t){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(t)}function R(t){if(!t)return u.slice(0,3);const e=t.toLowerCase().split("-"),n=e[0],o=e.length>1?e[1]:"";let r=[];return n&&o&&(r=c.filter(i=>i.startsWith(`${n}-${o}`))),r.length===0&&n&&(r=c.filter(i=>i.startsWith(`${n}-`))),r.length>0?r.slice(0,3):u.slice(0,3)}function d(t){if(p(t))return!0;const e=R(t);return l(t)?`Unknown region. Try: ${e.join(", ")}`:`Invalid format. Try: ${e.join(", ")}`}function A(t){if(!t||t.trim()==="")return!0;const e=a(t);for(const n of e){const o=d(n);if(o!==!0)return o}return!0}function x(t,e){return t.filter(n=>n!==e)}function E(){return s.map(t=>({label:t.city,value:t.code,description:t.code}))}function T(t){return s.filter(e=>e.code!==t).map(e=>({label:e.city,value:e.code,description:e.code}))}function h(t){const e=s.find(n=>n.code===t);return e?e.city:t}function I(t){return e=>{const n=a(e);return x(n,t)}}export{y as AWS_REGIONS_METADATA,S as DEFAULT_REGION,u as commonRegions,I as createRegionFormatter,x as filterDuplicateRegions,$ as getRegionInfo,h as getRegionName,E as getRegionOptions,T as getRegionOptionsExcluding,R as getSuggestions,p as isValidRegion,l as isValidRegionFormat,a as parseRegionList,z as regions,D as suggestRegionForTimezone,O as topRegions,d as validateRegion,A as validateRegionList};
+import{AWS_REGIONS_METADATA as s,getRegionInfo as f,regions as u}from"@fjall/util";import{AWS_REGIONS_METADATA as $,DEFAULT_REGION as w,getRegionInfo as D,OPT_IN_REGION_CODES as y,optInRegionWarning as z,regions as G,suggestRegionForTimezone as L}from"@fjall/util";const p=["us-east-2","us-west-2","us-east-1","eu-west-1","eu-central-1","ap-southeast-1"],E=Object.freeze(p.flatMap(t=>{const e=f(t);return e?[e]:[]})),c=Object.freeze(["us-east-2","us-west-2","us-east-1","eu-west-1","ap-southeast-1"]);function g(t){return t?t.split(",").map(e=>e.trim()).filter(Boolean):[]}function l(t){return u.includes(t)}function R(t){return/^[a-z]{2}-[a-z]+-[1-9]$/.test(t)}function x(t){if(!t)return c.slice(0,3);const e=t.toLowerCase().split("-"),n=e[0],o=e.length>1?e[1]:"";let r=[];return n&&o&&(r=u.filter(i=>i.startsWith(`${n}-${o}`))),r.length===0&&n&&(r=u.filter(i=>i.startsWith(`${n}-`))),r.length>0?r.slice(0,3):c.slice(0,3)}function d(t){if(l(t))return!0;const e=x(t);return R(t)?`Unknown region. Try: ${e.join(", ")}`:`Invalid format. Try: ${e.join(", ")}`}function I(t){if(!t||t.trim()==="")return!0;const e=g(t);for(const n of e){const o=d(n);if(o!==!0)return o}return!0}function m(t,e){return t.filter(n=>n!==e)}function a(t){return{label:t.city,value:t.code,description:t.optIn?`${t.code} \u2014 opt-in required`:t.code}}function T(){return s.map(a)}function _(t){return s.filter(e=>e.code!==t).map(a)}function A(t){const e=s.find(n=>n.code===t);return e?e.city:t}function h(t){return e=>{const n=g(e);return m(n,t)}}export{$ as AWS_REGIONS_METADATA,w as DEFAULT_REGION,y as OPT_IN_REGION_CODES,c as commonRegions,h as createRegionFormatter,m as filterDuplicateRegions,D as getRegionInfo,A as getRegionName,T as getRegionOptions,_ as getRegionOptionsExcluding,x as getSuggestions,l as isValidRegion,R as isValidRegionFormat,z as optInRegionWarning,g as parseRegionList,G as regions,L as suggestRegionForTimezone,E as topRegions,d as validateRegion,I as validateRegionList};

package/dist/src/codemod/index.d.ts

@@ -7,6 +7,7 @@ export { addVpcPeerAccepter, modifyVpcPeerAccepter, removeVpcPeerAccepter, type
 export { addCrossPlanConnection, modifyCrossPlanConnection, removeCrossPlanConnection, type CrossPlanConnectionAddOptions, type CrossPlanConnectionModifyOptions, type CrossPlanConnectionOrchestratorSuccess, type CrossPlanConnectionRemoveOptions, } from "./edits/crossPlanConnection.js";
 export { resolveDriftPolicy, type DriftAction, type DriftDecision, } from "./edits/driftPolicy.js";
 export { listResources, type ListResourcesError } from "./listResources.js";
+export { resolveConstructByLiteralProperty, type ConstructResolution, type ConstructResolutionFailureReason, type ResolveConstructQuery, type ResolvedConstruct, } from "./semanticIndex/index.js";
 export { parse } from "./fileRewriter/parse.js";
 export { CrossPlanConnectionResourcePlanSchema, VpcPeerAccepterResourcePlanSchema, VpcPeerResourcePlanSchema, } from "../schemas/index.js";
 export type { CrossPlanConnectionResourcePlan, VpcPeerAccepterResourcePlan, VpcPeerResourcePlan, } from "../schemas/index.js";

package/dist/src/codemod/index.js

@@ -1 +1 @@
-import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as a}from"./edits/appendAccountToStage.js";import{addVpcPeer as d,modifyVpcPeer as i,removeVpcPeer as l}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as u,modifyVpcPeerAccepter as P,removeVpcPeerAccepter as E}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as R,modifyCrossPlanConnection as v,removeCrossPlanConnection as S}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as C}from"./edits/driftPolicy.js";import{listResources as V}from"./listResources.js";import{parse as h}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as D,VpcPeerAccepterResourcePlanSchema as _,VpcPeerResourcePlanSchema as F}from"../schemas/index.js";import{detectDrift as N,mergeProperties as g,snapshotProperties as k}from"./drift/index.js";import{computeLinesDelta as O}from"./_internal.js";import{ResourceNameSchema as I,StatementTypeSchema as K}from"./types.js";import{CODEMOD_ERROR_KINDS as U}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as q,buildFiredEvent as w,buildGateFailedEvent as z,buildGatePassedEvent as H,buildRejectedEvent as J,buildSucceededEvent as Q,buildTimeoutEvent as W,estimateCostUsd as X,FALLBACK_EVENTS as Y,GATE_EVENTS as Z,PARSE_GATE as $,RUNTIME_GATE as ee,runFallback as re,shouldTryFallback as oe}from"./llmFallback/index.js";export{U as CODEMOD_ERROR_KINDS,D as CrossPlanConnectionResourcePlanSchema,Y as FALLBACK_EVENTS,Z as GATE_EVENTS,$ as PARSE_GATE,ee as RUNTIME_GATE,I as ResourceNameSchema,K as StatementTypeSchema,_ as VpcPeerAccepterResourcePlanSchema,F as VpcPeerResourcePlanSchema,R as addCrossPlanConnection,o as addResource,d as addVpcPeer,u as addVpcPeerAccepter,a as appendAccountToStage,q as buildEgressBlockedEvent,w as buildFiredEvent,z as buildGateFailedEvent,H as buildGatePassedEvent,J as buildRejectedEvent,Q as buildSucceededEvent,W as buildTimeoutEvent,O as computeLinesDelta,N as detectDrift,X as estimateCostUsd,V as listResources,g as mergeProperties,v as modifyCrossPlanConnection,m as modifyResource,i as modifyVpcPeer,P as modifyVpcPeerAccepter,h as parse,S as removeCrossPlanConnection,c as removeResource,l as removeVpcPeer,E as removeVpcPeerAccepter,C as resolveDriftPolicy,re as runFallback,oe as shouldTryFallback,k as snapshotProperties};
+import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as a}from"./edits/appendAccountToStage.js";import{addVpcPeer as d,modifyVpcPeer as i,removeVpcPeer as l}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as u,modifyVpcPeerAccepter as P,removeVpcPeerAccepter as E}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as R,modifyCrossPlanConnection as v,removeCrossPlanConnection as C}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as A}from"./edits/driftPolicy.js";import{listResources as V}from"./listResources.js";import{resolveConstructByLiteralProperty as y}from"./semanticIndex/index.js";import{parse as D}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as G,VpcPeerResourcePlanSchema as N}from"../schemas/index.js";import{detectDrift as g,mergeProperties as k,snapshotProperties as B}from"./drift/index.js";import{computeLinesDelta as I}from"./_internal.js";import{ResourceNameSchema as M,StatementTypeSchema as U}from"./types.js";import{CODEMOD_ERROR_KINDS as q}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as z,buildFiredEvent as H,buildGateFailedEvent as J,buildGatePassedEvent as Q,buildRejectedEvent as W,buildSucceededEvent as X,buildTimeoutEvent as Y,estimateCostUsd as Z,FALLBACK_EVENTS as $,GATE_EVENTS as ee,PARSE_GATE as re,RUNTIME_GATE as oe,runFallback as te,shouldTryFallback as ce}from"./llmFallback/index.js";export{q as CODEMOD_ERROR_KINDS,F as CrossPlanConnectionResourcePlanSchema,$ as FALLBACK_EVENTS,ee as GATE_EVENTS,re as PARSE_GATE,oe as RUNTIME_GATE,M as ResourceNameSchema,U as StatementTypeSchema,G as VpcPeerAccepterResourcePlanSchema,N as VpcPeerResourcePlanSchema,R as addCrossPlanConnection,o as addResource,d as addVpcPeer,u as addVpcPeerAccepter,a as appendAccountToStage,z as buildEgressBlockedEvent,H as buildFiredEvent,J as buildGateFailedEvent,Q as buildGatePassedEvent,W as buildRejectedEvent,X as buildSucceededEvent,Y as buildTimeoutEvent,I as computeLinesDelta,g as detectDrift,Z as estimateCostUsd,V as listResources,k as mergeProperties,v as modifyCrossPlanConnection,m as modifyResource,i as modifyVpcPeer,P as modifyVpcPeerAccepter,D as parse,C as removeCrossPlanConnection,c as removeResource,l as removeVpcPeer,E as removeVpcPeerAccepter,y as resolveConstructByLiteralProperty,A as resolveDriftPolicy,te as runFallback,ce as shouldTryFallback,B as snapshotProperties};

package/dist/src/codemod/semanticIndex/index.d.ts

@@ -1,4 +1,5 @@
-export { locateByShape, locateAllShapes, type NodeLocation, type StatementType, type LocateByShapeError, } from "./locateByShape.js";
+export { locateByShape, locateAllShapes, forEachFactoryMatch, type FactoryCallMatch, type NodeLocation, type StatementType, type LocateByShapeError, } from "./locateByShape.js";
+export { resolveConstructByLiteralProperty, type ConstructResolution, type ConstructResolutionFailureReason, type ResolveConstructQuery, type ResolvedConstruct, } from "./resolveConstructByLiteralProperty.js";
 export { findReferences, type ReferenceLocation, type FindReferencesError, } from "./findReferences.js";
 export { getProject, resetProjectForTest } from "./projectCache.js";
 export { listImports, type ImportInfo, type ListImportsError, } from "./listImports.js";

package/dist/src/codemod/semanticIndex/index.js

@@ -1 +1 @@
-import{locateByShape as r,locateAllShapes as t}from"./locateByShape.js";import{findReferences as f}from"./findReferences.js";import{getProject as c,resetProjectForTest as l}from"./projectCache.js";import{listImports as a}from"./listImports.js";export{f as findReferences,c as getProject,a as listImports,t as locateAllShapes,r as locateByShape,l as resetProjectForTest};
+import{locateByShape as o,locateAllShapes as t,forEachFactoryMatch as c}from"./locateByShape.js";import{resolveConstructByLiteralProperty as a}from"./resolveConstructByLiteralProperty.js";import{findReferences as s}from"./findReferences.js";import{getProject as m,resetProjectForTest as x}from"./projectCache.js";import{listImports as y}from"./listImports.js";export{s as findReferences,c as forEachFactoryMatch,m as getProject,y as listImports,t as locateAllShapes,o as locateByShape,x as resetProjectForTest,a as resolveConstructByLiteralProperty};

package/dist/src/codemod/semanticIndex/locateByShape.d.ts

@@ -1,3 +1,4 @@
+import { type CallExpression } from "ts-morph";
 import { type Result } from "../../types/Result.js";
 import type { NodeLocation, StatementType, TemplateLiteralNameError, SemanticQueryError } from "../types.js";
 export type { NodeLocation, StatementType } from "../types.js";
@@ -13,6 +14,16 @@ export declare function locateByShape(content: string, query: {
     type: StatementType;
     name: string;
 }, filePath?: string): Result<NodeLocation | undefined, LocateByShapeError>;
+/**
+ * A `XFactory.build("Name", ...)` call whose name is a plain string
+ * literal. `nameStart`/`nameLength` anchor the name token (ADR §4(a)).
+ */
+export interface FactoryCallMatch {
+    type: StatementType;
+    name: string;
+    nameStart: number;
+    nameLength: number;
+}
 /**
  * Walks every call expression in the source and returns a
  * `NodeLocation & { type }` for each `XFactory.build("Name", ...)`
@@ -26,3 +37,15 @@ export declare function locateByShape(content: string, query: {
 export declare function locateAllShapes(content: string, filePath?: string): Result<Array<NodeLocation & {
     type: StatementType;
 }>, LocateByShapeError>;
+/**
+ * Shared walk over every `XFactory.build("Name", ...)` call with a
+ * plain string-literal name. Invokes `onMatch(match, call)` for each —
+ * `match` carries the resolved name + token span, while `call` is the
+ * live ts-morph node so callers can read further arguments (e.g. the
+ * second-argument config object literal).
+ *
+ * Binding-pattern and type-space calls are skipped (parity with the
+ * `locateByShape` contract); the first template-literal name aborts the
+ * walk as a `TemplateLiteralNameError` failure.
+ */
+export declare function forEachFactoryMatch(content: string, filePath: string, onMatch: (match: FactoryCallMatch, call: CallExpression) => void): Result<void, LocateByShapeError>;

package/dist/src/codemod/semanticIndex/locateByShape.js

@@ -1 +1 @@
-import{Node as s,SyntaxKind as a}from"ts-morph";import{failure as c,success as l}from"../../types/Result.js";import{DEFAULT_FILE_PATH as u}from"../_internal.js";import{findTypeByIdentifier as p}from"../registry.js";import{getProject as m}from"./projectCache.js";function b(n,t,e=u){const o=g(n,e);if(!o.success)return o;const r=o.data.find(i=>i.type===t.type&&i.symbolName===t.name);return l(r)}function g(n,t=u){let e;try{e=m().createSourceFile(t,n,{overwrite:!0})}catch(r){return c({kind:"SemanticQueryError",reason:"Failed to create source file",cause:r})}const o=[];try{e.forEachDescendant(r=>{if(!s.isCallExpression(r))return;const i=y(r);if(i!=="not-factory-call"&&i.kind!=="binding-pattern-declared"){if(i.kind==="template-literal-name")throw new f(r,i.type);o.push({filePath:t,start:i.nameStart,length:i.nameLength,symbolName:i.name,type:i.type})}})}catch(r){return r instanceof f?c(r.toError(t)):c({kind:"SemanticQueryError",reason:"forEachDescendant traversal failed",cause:r})}return l(o)}function y(n){const t=n.getExpression();if(!s.isPropertyAccessExpression(t))return"not-factory-call";const e=h(t);if(e===void 0||E(n))return"not-factory-call";if(S(n))return{kind:"binding-pattern-declared"};const r=n.getArguments()[0];return r===void 0?"not-factory-call":s.isTemplateExpression(r)||s.isNoSubstitutionTemplateLiteral(r)?{kind:"template-literal-name",type:e}:s.isStringLiteral(r)?{kind:"match",type:e,name:r.getLiteralValue(),nameStart:r.getStart(),nameLength:r.getWidth()}:"not-factory-call"}function h(n){const t=n.getExpression();if(s.isIdentifier(t)&&n.getName()==="build")return p(t.getText())}function E(n){let t=n.getParent();for(;t!==void 0;){const e=t.getKind();if(e===a.TypeReference||e===a.TypeQuery||e===a.TypeLiteral||e===a.TypeAliasDeclaration||e===a.InterfaceDeclaration||e===a.TypeParameter||e===a.PropertySignature||e===a.MethodSignature||e===a.JsxOpeningElement||e===a.JsxClosingElement||e===a.JsxSelfClosingElement||e===a.JsxAttribute)return!0;t=t.getParent()}return!1}function S(n){const t=n.getFirstAncestorByKind(a.VariableDeclaration);if(t===void 0)return!1;const o=t.getNameNode().getKind();return o===a.ObjectBindingPattern||o===a.ArrayBindingPattern}class f extends Error{call;type;constructor(t,e){super("Template-literal factory name detected"),this.call=t,this.type=e,this.name="TemplateLiteralMarker"}toError(t){const o=this.call.getArguments()[0]?.getStart()??this.call.getStart(),r=this.call.getSourceFile(),{line:i,column:d}=r.getLineAndColumnAtPos(o);return{kind:"TemplateLiteralNameError",file:t,line:i,column:d,suggestion:"Replace the template literal with a plain string literal so the resource name can be resolved statically."}}}export{g as locateAllShapes,b as locateByShape};
+import{Node as s,SyntaxKind as i}from"ts-morph";import{failure as c,success as l}from"../../types/Result.js";import{DEFAULT_FILE_PATH as u}from"../_internal.js";import{findTypeByIdentifier as d}from"../registry.js";import{getProject as m}from"./projectCache.js";function b(n,r,t=u){const a=g(n,t);if(!a.success)return a;const e=a.data.find(o=>o.type===r.type&&o.symbolName===r.name);return l(e)}function g(n,r=u){const t=[],a=y(n,r,e=>{t.push({filePath:r,start:e.nameStart,length:e.nameLength,symbolName:e.name,type:e.type})});return a.success?l(t):a}function y(n,r,t){let a;try{a=m().createSourceFile(r,n,{overwrite:!0})}catch(e){return c({kind:"SemanticQueryError",reason:"Failed to create source file",cause:e})}try{a.forEachDescendant(e=>{if(!s.isCallExpression(e))return;const o=h(e);if(o!=="not-factory-call"&&o.kind!=="binding-pattern-declared"){if(o.kind==="template-literal-name")throw new f(e,o.type);t({type:o.type,name:o.name,nameStart:o.nameStart,nameLength:o.nameLength},e)}})}catch(e){return e instanceof f?c(e.toError(r)):c({kind:"SemanticQueryError",reason:"forEachDescendant traversal failed",cause:e})}return l(void 0)}function h(n){const r=n.getExpression();if(!s.isPropertyAccessExpression(r))return"not-factory-call";const t=S(r);if(t===void 0||E(n))return"not-factory-call";if(T(n))return{kind:"binding-pattern-declared"};const e=n.getArguments()[0];return e===void 0?"not-factory-call":s.isTemplateExpression(e)||s.isNoSubstitutionTemplateLiteral(e)?{kind:"template-literal-name",type:t}:s.isStringLiteral(e)?{kind:"match",type:t,name:e.getLiteralValue(),nameStart:e.getStart(),nameLength:e.getWidth()}:"not-factory-call"}function S(n){const r=n.getExpression();if(s.isIdentifier(r)&&n.getName()==="build")return d(r.getText())}function E(n){let r=n.getParent();for(;r!==void 0;){const t=r.getKind();if(t===i.TypeReference||t===i.TypeQuery||t===i.TypeLiteral||t===i.TypeAliasDeclaration||t===i.InterfaceDeclaration||t===i.TypeParameter||t===i.PropertySignature||t===i.MethodSignature||t===i.JsxOpeningElement||t===i.JsxClosingElement||t===i.JsxSelfClosingElement||t===i.JsxAttribute)return!0;r=r.getParent()}return!1}function T(n){const r=n.getFirstAncestorByKind(i.VariableDeclaration);if(r===void 0)return!1;const a=r.getNameNode().getKind();return a===i.ObjectBindingPattern||a===i.ArrayBindingPattern}class f extends Error{call;type;constructor(r,t){super("Template-literal factory name detected"),this.call=r,this.type=t,this.name="TemplateLiteralMarker"}toError(r){const a=this.call.getArguments()[0]?.getStart()??this.call.getStart(),e=this.call.getSourceFile(),{line:o,column:p}=e.getLineAndColumnAtPos(a);return{kind:"TemplateLiteralNameError",file:r,line:o,column:p,suggestion:"Replace the template literal with a plain string literal so the resource name can be resolved statically."}}}export{y as forEachFactoryMatch,g as locateAllShapes,b as locateByShape};

package/dist/src/codemod/semanticIndex/resolveConstructByLiteralProperty.d.ts

@@ -0,0 +1,48 @@
+import { type Result } from "../../types/Result.js";
+import type { StatementType } from "../types.js";
+import { type LocateByShapeError } from "./locateByShape.js";
+export type { LocateByShapeError } from "./locateByShape.js";
+/**
+ * A `XFactory.build("constructId", …)` construct of a given statement type.
+ */
+export interface ResolvedConstruct {
+    type: StatementType;
+    constructId: string;
+    filePath: string;
+}
+/**
+ * Why a literal-property resolution did not yield a single construct.
+ *  - `no-literal-match`: no construct of the queried type carries the property
+ *    as a string literal equal to `value`. `candidates` lists every construct
+ *    of that type so the caller can report what it did find.
+ *  - `ambiguous`: more than one construct's literal property equalled `value`.
+ *    `candidates` lists the colliding constructs.
+ */
+export type ConstructResolutionFailureReason = "no-literal-match" | "ambiguous";
+export type ConstructResolution = {
+    resolved: true;
+    construct: ResolvedConstruct;
+} | {
+    resolved: false;
+    reason: ConstructResolutionFailureReason;
+    candidates: ResolvedConstruct[];
+};
+export interface ResolveConstructQuery {
+    /** Restrict the search to constructs of this factory statement type. */
+    type: StatementType;
+    /** Config-object property whose literal value to match (e.g. `bucketName`). */
+    property: string;
+    /** The physical value to match against (e.g. the quarantined bucket name). */
+    value: string;
+}
+/**
+ * Resolves the construct id whose factory-call config object sets
+ * `query.property` to the string literal `query.value`.
+ *
+ * Returns `failure(...)` only for a genuine parse / semantic-query error or a
+ * template-literal factory name (the engine cannot statically locate those).
+ * A clean run that simply finds no unique match returns
+ * `success({ resolved: false, … })` — the caller decides whether to degrade to
+ * report-only.
+ */
+export declare function resolveConstructByLiteralProperty(content: string, query: ResolveConstructQuery, filePath?: string): Result<ConstructResolution, LocateByShapeError>;

package/dist/src/codemod/semanticIndex/resolveConstructByLiteralProperty.js

@@ -0,0 +1 @@
+import{Node as s}from"ts-morph";import{success as u}from"../../types/Result.js";import{DEFAULT_FILE_PATH as p}from"../_internal.js";import{forEachFactoryMatch as g}from"./locateByShape.js";function A(i,n,t=p){const r=[],e=[],c=g(i,t,(o,l)=>{if(o.type!==n.type)return;const a={type:o.type,constructId:o.name,filePath:t};r.push(a);const f=m(l,n.property);f!==void 0&&f===n.value&&e.push(a)});if(!c.success)return c;const[d]=e;return e.length===1&&d!==void 0?u({resolved:!0,construct:d}):e.length===0?u({resolved:!1,reason:"no-literal-match",candidates:r}):u({resolved:!1,reason:"ambiguous",candidates:e})}function m(i,n){const t=i.getArguments()[1];if(t===void 0||!s.isObjectLiteralExpression(t))return;const r=t.getProperty(n);if(r===void 0||!s.isPropertyAssignment(r))return;const e=r.getInitializer();if(!(e===void 0||!s.isStringLiteral(e)))return e.getLiteralValue()}export{A as resolveConstructByLiteralProperty};

package/dist/src/index.d.ts

@@ -1,7 +1,7 @@
 export { normaliseError, getErrorMessage } from "./util/errorUtils.js";
 export { type Result, isSuccess, isFailure, success, failure, tryAsync, trySync, } from "./types/Result.js";
 export { VALIDATION_PATTERNS, VALIDATION_MESSAGES, parseRateExpression, type ValidationPatternKey, type ValidationMessageKey, } from "./validation/patterns.js";
-export { type RegionCode, type RegionInfo, DEFAULT_REGION, regions, AWS_REGIONS_METADATA, getRegionInfo, suggestRegionForTimezone, topRegions, commonRegions, parseRegionList, isValidRegion, isValidRegionFormat, getSuggestions, validateRegion, validateRegionList, filterDuplicateRegions, getRegionOptions, getRegionOptionsExcluding, getRegionName, createRegionFormatter, } from "./aws/regions.js";
+export { type RegionCode, type RegionInfo, DEFAULT_REGION, regions, AWS_REGIONS_METADATA, getRegionInfo, OPT_IN_REGION_CODES, optInRegionWarning, suggestRegionForTimezone, topRegions, commonRegions, parseRegionList, isValidRegion, isValidRegionFormat, getSuggestions, validateRegion, validateRegionList, filterDuplicateRegions, getRegionOptions, getRegionOptionsExcluding, getRegionName, createRegionFormatter, } from "./aws/regions.js";
 export { GENERATOR_VERSION } from "./version.js";
 export * from "./schemas/index.js";
 export * from "./generation/index.js";

package/dist/src/index.js

@@ -1 +1 @@
-import{normaliseError as r,getErrorMessage as i}from"./util/errorUtils.js";import{isSuccess as s,isFailure as g,success as n,failure as R,tryAsync as a,trySync as m}from"./types/Result.js";import{VALIDATION_PATTERNS as f,VALIDATION_MESSAGES as E,parseRateExpression as x}from"./validation/patterns.js";import{DEFAULT_REGION as c,regions as l,AWS_REGIONS_METADATA as S,getRegionInfo as T,suggestRegionForTimezone as u,topRegions as I,commonRegions as N,parseRegionList as O,isValidRegion as _,isValidRegionFormat as d,getSuggestions as D,validateRegion as F,validateRegionList as L,filterDuplicateRegions as V,getRegionOptions as y,getRegionOptionsExcluding as G,getRegionName as M,createRegionFormatter as v}from"./aws/regions.js";import{GENERATOR_VERSION as P}from"./version.js";export*from"./schemas/index.js";export*from"./generation/index.js";export*from"./presets/index.js";export*from"./ast/index.js";export*from"./planning/index.js";export*from"./dns/index.js";export{S as AWS_REGIONS_METADATA,c as DEFAULT_REGION,P as GENERATOR_VERSION,E as VALIDATION_MESSAGES,f as VALIDATION_PATTERNS,N as commonRegions,v as createRegionFormatter,R as failure,V as filterDuplicateRegions,i as getErrorMessage,T as getRegionInfo,M as getRegionName,y as getRegionOptions,G as getRegionOptionsExcluding,D as getSuggestions,g as isFailure,s as isSuccess,_ as isValidRegion,d as isValidRegionFormat,r as normaliseError,x as parseRateExpression,O as parseRegionList,l as regions,n as success,u as suggestRegionForTimezone,I as topRegions,a as tryAsync,m as trySync,F as validateRegion,L as validateRegionList};
+import{normaliseError as r,getErrorMessage as i}from"./util/errorUtils.js";import{isSuccess as n,isFailure as g,success as s,failure as R,tryAsync as a,trySync as p}from"./types/Result.js";import{VALIDATION_PATTERNS as E,VALIDATION_MESSAGES as f,parseRateExpression as x}from"./validation/patterns.js";import{DEFAULT_REGION as I,regions as O,AWS_REGIONS_METADATA as S,getRegionInfo as c,OPT_IN_REGION_CODES as l,optInRegionWarning as N,suggestRegionForTimezone as T,topRegions as _,commonRegions as u,parseRegionList as D,isValidRegion as d,isValidRegionFormat as F,getSuggestions as G,validateRegion as L,validateRegionList as V,filterDuplicateRegions as y,getRegionOptions as M,getRegionOptionsExcluding as v,getRegionName as P,createRegionFormatter as W}from"./aws/regions.js";import{GENERATOR_VERSION as C}from"./version.js";export*from"./schemas/index.js";export*from"./generation/index.js";export*from"./presets/index.js";export*from"./ast/index.js";export*from"./planning/index.js";export*from"./dns/index.js";export{S as AWS_REGIONS_METADATA,I as DEFAULT_REGION,C as GENERATOR_VERSION,l as OPT_IN_REGION_CODES,f as VALIDATION_MESSAGES,E as VALIDATION_PATTERNS,u as commonRegions,W as createRegionFormatter,R as failure,y as filterDuplicateRegions,i as getErrorMessage,c as getRegionInfo,P as getRegionName,M as getRegionOptions,v as getRegionOptionsExcluding,G as getSuggestions,g as isFailure,n as isSuccess,d as isValidRegion,F as isValidRegionFormat,r as normaliseError,N as optInRegionWarning,x as parseRateExpression,D as parseRegionList,O as regions,s as success,T as suggestRegionForTimezone,_ as topRegions,a as tryAsync,p as trySync,L as validateRegion,V as validateRegionList};

package/dist/src/schemas/applicationSchemas.d.ts

@@ -465,6 +465,17 @@ export declare const ApplicationResourcePlanSchema: z.ZodObject<{
             }, z.core.$strict>>;
         }, z.core.$strict>>;
         retain: z.ZodOptional<z.ZodBoolean>;
+        resourcePolicyStatements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            sid: z.ZodOptional<z.ZodString>;
+            effect: z.ZodEnum<{
+                Allow: "Allow";
+                Deny: "Deny";
+            }>;
+            principals: z.ZodArray<z.ZodString>;
+            actions: z.ZodArray<z.ZodString>;
+            resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>>;
+        }, z.core.$strict>>>;
         stackPlacement: z.ZodOptional<z.ZodEnum<{
             storage: "storage";
             compute: "compute";

package/dist/src/schemas/storageSchemas.d.ts

@@ -6,6 +6,25 @@ import { z } from "zod";
  * - "compute": Created in Compute stack for Lambda-consumed buckets
  */
 export declare const S3_STACK_PLACEMENTS: readonly ["storage", "cdn", "compute"];
+/**
+ * A declarative bucket-policy statement. Mirrors the `ResourcePolicyStatement`
+ * interface on the `S3Bucket` construct in `@fjall/components-infrastructure` —
+ * the two shapes must move together. The codemod sets this as a typed prop on an
+ * existing `StorageFactory.build("Name", { … })` call; the construct turns each
+ * entry into an `addToResourcePolicy` call at synth.
+ */
+export declare const ResourcePolicyStatementSchema: z.ZodObject<{
+    sid: z.ZodOptional<z.ZodString>;
+    effect: z.ZodEnum<{
+        Allow: "Allow";
+        Deny: "Deny";
+    }>;
+    principals: z.ZodArray<z.ZodString>;
+    actions: z.ZodArray<z.ZodString>;
+    resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>>;
+}, z.core.$strict>;
+export type ResourcePolicyStatement = z.infer<typeof ResourcePolicyStatementSchema>;
 export declare const S3ResourcePlanSchema: z.ZodObject<{
     name: z.ZodString;
     bucketName: z.ZodOptional<z.ZodString>;
@@ -41,6 +60,17 @@ export declare const S3ResourcePlanSchema: z.ZodObject<{
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     retain: z.ZodOptional<z.ZodBoolean>;
+    resourcePolicyStatements: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        sid: z.ZodOptional<z.ZodString>;
+        effect: z.ZodEnum<{
+            Allow: "Allow";
+            Deny: "Deny";
+        }>;
+        principals: z.ZodArray<z.ZodString>;
+        actions: z.ZodArray<z.ZodString>;
+        resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        conditions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>>;
+    }, z.core.$strict>>>;
     stackPlacement: z.ZodOptional<z.ZodEnum<{
         storage: "storage";
         compute: "compute";

package/dist/src/schemas/storageSchemas.js

@@ -1 +1 @@
-import{z as o}from"zod";import{VALIDATION_MESSAGES as t}from"../validation/patterns.js";import{BACKUP_VAULT_TIERS as n,S3_ENCRYPTION_TYPES as a,STORAGE_PRESET_TYPES as r}from"./constants.js";import{ResourceNameSchema as i,BucketNameSchema as s,AppNameSchema as l,ExtraPropertySchema as p}from"./baseSchemas.js";const c=["storage","cdn","compute"],y=o.object({name:i,bucketName:o.string().optional(),publicReadAccess:o.boolean().optional(),websiteHosting:o.object({indexDocument:o.string(),errorDocument:o.string().optional()}).strict().optional(),backupVaultTier:o.enum(n).optional(),versioned:o.boolean().optional(),encryption:o.enum(a).optional(),kmsKeyArn:o.string().optional(),cors:o.array(o.object({allowedOrigins:o.array(o.string()),allowedMethods:o.array(o.string()),allowedHeaders:o.array(o.string()).optional(),exposedHeaders:o.array(o.string()).optional(),maxAge:o.number().optional()}).strict()).optional(),deployment:o.object({source:o.string(),prune:o.boolean().optional(),cacheControl:o.object({maxAge:o.number().optional(),immutable:o.boolean().optional()}).strict().optional()}).strict().optional(),retain:o.boolean().optional(),stackPlacement:o.enum(c).optional(),variableName:o.string().optional(),extraProperties:o.array(p).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:t.KMS.KEY_REQUIRED}),S=o.object({appName:l,bucketName:s,nameProvidedByFlag:o.boolean().optional(),storagePreset:o.enum(r).optional(),publicReadAccess:o.boolean().optional(),websiteHosting:o.object({indexDocument:o.string(),errorDocument:o.string().optional()}).strict().optional(),backupVaultTier:o.enum(n).optional(),versioned:o.boolean().optional(),encryption:o.enum(a).optional(),kmsKeyArn:o.string().optional(),cors:o.array(o.object({allowedOrigins:o.array(o.string()),allowedMethods:o.array(o.string()),allowedHeaders:o.array(o.string()).optional(),exposedHeaders:o.array(o.string()).optional(),maxAge:o.number().optional()}).strict()).optional(),connectionConfig:o.object({connectToCompute:o.array(o.string()).optional(),connectToServices:o.array(o.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:t.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});export{S as S3GeneratorSchema,y as S3ResourcePlanSchema,c as S3_STACK_PLACEMENTS};
+import{z as o}from"zod";import{VALIDATION_MESSAGES as t}from"../validation/patterns.js";import{BACKUP_VAULT_TIERS as r,S3_ENCRYPTION_TYPES as n,STORAGE_PRESET_TYPES as a}from"./constants.js";import{ResourceNameSchema as i,BucketNameSchema as s,AppNameSchema as c,ExtraPropertySchema as l}from"./baseSchemas.js";const p=["storage","cdn","compute"],m=o.object({sid:o.string().optional(),effect:o.enum(["Allow","Deny"]),principals:o.array(o.string()),actions:o.array(o.string()),resources:o.array(o.string()).optional(),conditions:o.record(o.string(),o.record(o.string(),o.union([o.string(),o.array(o.string())]))).optional()}).strict(),S=o.object({name:i,bucketName:o.string().optional(),publicReadAccess:o.boolean().optional(),websiteHosting:o.object({indexDocument:o.string(),errorDocument:o.string().optional()}).strict().optional(),backupVaultTier:o.enum(r).optional(),versioned:o.boolean().optional(),encryption:o.enum(n).optional(),kmsKeyArn:o.string().optional(),cors:o.array(o.object({allowedOrigins:o.array(o.string()),allowedMethods:o.array(o.string()),allowedHeaders:o.array(o.string()).optional(),exposedHeaders:o.array(o.string()).optional(),maxAge:o.number().optional()}).strict()).optional(),deployment:o.object({source:o.string(),prune:o.boolean().optional(),cacheControl:o.object({maxAge:o.number().optional(),immutable:o.boolean().optional()}).strict().optional()}).strict().optional(),retain:o.boolean().optional(),resourcePolicyStatements:o.array(m).optional(),stackPlacement:o.enum(p).optional(),variableName:o.string().optional(),extraProperties:o.array(l).optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:t.KMS.KEY_REQUIRED}),d=o.object({appName:c,bucketName:s,nameProvidedByFlag:o.boolean().optional(),storagePreset:o.enum(a).optional(),publicReadAccess:o.boolean().optional(),websiteHosting:o.object({indexDocument:o.string(),errorDocument:o.string().optional()}).strict().optional(),backupVaultTier:o.enum(r).optional(),versioned:o.boolean().optional(),encryption:o.enum(n).optional(),kmsKeyArn:o.string().optional(),cors:o.array(o.object({allowedOrigins:o.array(o.string()),allowedMethods:o.array(o.string()),allowedHeaders:o.array(o.string()).optional(),exposedHeaders:o.array(o.string()).optional(),maxAge:o.number().optional()}).strict()).optional(),connectionConfig:o.object({connectToCompute:o.array(o.string()).optional(),connectToServices:o.array(o.string()).optional()}).strict().optional()}).strict().refine(e=>e.encryption!=="KMS"||!!e.kmsKeyArn,{message:t.KMS.KEY_REQUIRED,path:["kmsKeyArn"]});export{m as ResourcePolicyStatementSchema,d as S3GeneratorSchema,S as S3ResourcePlanSchema,p as S3_STACK_PLACEMENTS};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "2.14.0";
+export declare const GENERATOR_VERSION = "2.15.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="2.14.0";export{E as GENERATOR_VERSION};
+const E="2.15.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "2.15.0",
+  "version": "2.16.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -43,7 +43,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^2.15.0",
+    "@fjall/util": "^2.16.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -59,5 +59,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "b2223855907cb6d467e47df073b2a5b28c684ede"
+  "gitHead": "2383b19f1e7db980ae603a6c75dca2c61b7a1d42"
 }