@fjall/generator 2.34.0 → 3.1.0

package/dist/src/schemas/computeSchemas.js

@@ -1 +1 @@
-import{z as e}from"zod";import{VALIDATION_PATTERNS as m,VALIDATION_MESSAGES as o}from"../validation/patterns.js";import{COMPUTE_TYPES as h,ECS_CAPACITY_PROVIDERS as f,EC2_INSTANCE_TYPES as k,HTTP_METHODS as j,MIN_LAMBDA_MEMORY as W,MAX_LAMBDA_MEMORY as w,MIN_LAMBDA_TIMEOUT as S,MAX_LAMBDA_TIMEOUT as g,MIN_ECS_CAPACITY as x,MAX_ECS_CAPACITY as O,MAX_SCALING_CAPACITY as p,MAX_WARM_POOL_SIZE as V,constIncludes as K,COMPUTE_ARCHITECTURES as F,FUNCTION_URL_AUTH_TYPES as L,DEPLOYMENT_TYPES as Z,AMI_HARDWARE_TYPES as z,LOAD_BALANCER_TYPES as Q,SCALING_TYPES as $}from"./constants.js";import{validateArchitectureMatch as q,getArchitectureForInstanceType as J}from"./instanceTypeArchitecture.js";import{optionalOrDisabled as ee,CAPACITY_REFINEMENT as r,memoryLimitMiBSchema as I,ResourceNameSchema as c,AppNameSchema as s,PortSchema as T,ExtraPropertySchema as l,EnvironmentRecordSchema as E,SecretsImportRecordSchema as oe}from"./baseSchemas.js";import{DockerBuildSchema as A}from"@fjall/util/manifest/schemas";import{EcsServiceAlarmConfigSchema as ne,LambdaAlarmConfigSchema as te}from"./alarmSchemas.js";function ie(n){return!(n.image!==void 0&&n.docker!==void 0)}const H=e.number().int(o.CAPACITY.MIN.INTEGER).min(x,o.GENERATOR_CAPACITY.MIN.MIN).max(O,o.GENERATOR_CAPACITY.MIN.MAX),D=e.number().int(o.CAPACITY.MAX.INTEGER).min(x,o.GENERATOR_CAPACITY.MAX.MIN).max(O,o.GENERATOR_CAPACITY.MAX.MAX),N=e.number().int(o.LAMBDA.MEMORY.INTEGER).min(W,o.LAMBDA.MEMORY.MIN).max(w,o.LAMBDA.MEMORY.MAX).refine(n=>n===128||n%64===0,o.LAMBDA.MEMORY.MULTIPLE),G=e.string().regex(m.LAMBDA_RUNTIME_IDENTIFIER,o.LAMBDA.RUNTIME),d=e.number().int(o.CPU.INTEGER).min(256,o.CPU.MIN).max(4096,o.CPU.MAX),u=e.number().int(o.CAPACITY.DESIRED.INTEGER).min(0,o.CAPACITY.DESIRED.MIN).max(p,o.CAPACITY.DESIRED.MAX),C=e.object({connectToDatabase:e.array(e.string()).optional()}).strict(),ae=e.object({minSize:e.number().int(o.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,o.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(V,o.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:e.boolean().optional()}).strict(),_=e.object({instanceType:e.string().optional(),amiHardwareType:e.enum(z).optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:I(128).optional(),warmPool:ae.optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(!n.instanceType||!n.amiHardwareType)return;const i=q(n.instanceType,n.amiHardwareType);i.valid||t.addIssue({code:"custom",message:i.message??o.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((n,t)=>{n.minCapacity===0&&!n.warmPool&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),n.warmPool?.minSize!==void 0&&n.maxCapacity!==void 0&&n.warmPool.minSize>n.maxCapacity&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),re=e.enum(h).describe(`Compute type must be one of: ${h.join(", ")}`),y=e.enum(f).describe(`ECS capacity provider must be one of: ${f.join(", ")}`),b=e.string().refine(n=>K(k,n),{message:o.INSTANCE_TYPE}),Y=e.object({sourceType:e.enum(["sqs","dynamodb","eventbridge"]),sourceRef:e.string().describe("Name of the source resource"),batchSize:e.number().int(o.BATCH_SIZE.INTEGER).min(1,o.BATCH_SIZE.MIN).max(1e4,o.BATCH_SIZE.MAX).optional(),startingPosition:e.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:e.number().int(o.BATCHING_WINDOW.INTEGER).min(0,o.BATCHING_WINDOW.MIN).max(300,o.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:e.boolean().optional()}).strict(),ce=e.object({name:e.string().min(1,o.REQUIRED.CONTAINER_NAME).optional(),image:e.string().optional(),port:T.optional(),environment:E.optional(),secretsImport:oe.optional(),command:e.array(e.string()).optional(),entryPoint:e.array(e.string()).optional(),essential:e.boolean().optional(),healthCheck:e.object({command:e.array(e.string()),interval:e.number().int(o.HEALTH_CHECK.INTERVAL.INTEGER).min(5,o.HEALTH_CHECK.INTERVAL.MIN).max(300,o.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:e.number().int(o.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,o.HEALTH_CHECK.TIMEOUT.MIN).max(60,o.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:e.number().int(o.HEALTH_CHECK.RETRIES.INTEGER).min(1,o.HEALTH_CHECK.RETRIES.MIN).max(10,o.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:e.number().int(o.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,o.HEALTH_CHECK.START_PERIOD.MIN).max(300,o.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:e.array(e.string().regex(m.SECRET_NAME,o.SECRET_NAME)).optional(),extraProperties:e.array(l).optional()}).strict(),v=e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.ECS_SERVICE_NAME,o.ECS_SERVICE_NAME),U=e.object({domain:e.string().optional(),loadBalancer:e.union([e.literal(!1),e.enum(Q)]).optional(),directAccess:e.boolean().optional(),extraProperties:e.array(l).optional()}).strict().refine(n=>!(n.directAccess&&n.domain),{message:o.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(n=>!(n.directAccess&&typeof n.loadBalancer=="string"),{message:o.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),M=e.object({path:e.string().optional(),host:e.string().optional(),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional(),healthCheckPath:e.string().optional()}).strict().describe("Path/host-based routing configuration"),se=e.object({desiredCount:u.optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),scalingType:e.enum($).optional()}).strict().refine(r.check,r.params).describe("ECS service scaling configuration"),B=e.object({name:v,docker:A.optional(),needsDatabaseConnection:e.boolean().optional(),needsStorageConnection:e.boolean().optional(),needsMessagingConnection:e.boolean().optional(),image:e.string().optional(),containers:e.array(ce).optional(),routing:e.union([M,e.array(M).min(1)]).optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),scaling:ee(se).optional(),capacityProvider:y,ec2Config:_.optional(),ssmSecretsPath:e.string().regex(m.SSM_PATH,o.SSM_PATH).optional(),extraProperties:e.array(l).optional(),alarms:ne.optional()}).strict().superRefine((n,t)=>{ie(n)||t.addIssue({code:"custom",path:["docker"],message:o.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),Re=e.object({name:c,type:re,needsConnection:e.boolean(),connectedDatabase:e.array(e.string()).optional(),connectedStorage:e.array(e.string()).optional(),connectedMessaging:e.array(e.string()).optional(),cluster:U.optional(),services:e.array(B).optional(),docker:A.partial().optional(),deployment:e.enum(Z).optional(),codePath:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:G.optional(),environment:E.optional(),secrets:E.optional(),eventSources:e.array(Y).optional(),functionUrl:e.object({authType:e.enum(L)}).strict().optional(),description:e.string().optional(),scheduleExpression:e.string().optional(),architecture:e.enum(F).optional(),ephemeralStorageSize:e.number().int(o.EPHEMERAL_STORAGE.INTEGER).min(512,o.EPHEMERAL_STORAGE.MIN).max(10240,o.EPHEMERAL_STORAGE.MAX).optional(),functionName:e.string().optional(),ssmSecrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),alarms:te.optional(),instanceType:b.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional(),variableName:e.string().optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(n.type==="ecs"&&n.services)for(let i=0;i<n.services.length;i++){const a=n.services[i];a?.ec2Config?.instanceType&&!a.ec2Config.amiHardwareType&&J(a.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${a.name??i}' uses instance type '${a.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",i,"ec2Config","instanceType"]})}n.type==="lambda"&&n.deployment==="container"&&n.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),Se=e.object({appName:s,clusterName:c,containerPort:T,nameProvidedByFlag:e.boolean().optional(),ecrRepository:e.string().optional(),capacityProvider:y.optional(),useAppEcr:e.boolean().optional(),desiredCount:u.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),minCapacity:H.optional(),maxCapacity:D.optional(),ec2Config:_.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),ge=e.object({appName:s,functionName:c,nameProvidedByFlag:e.boolean().optional(),lambdaType:e.enum(["basic","web","custom"]).optional(),ecrRepository:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),enableFunctionUrl:e.boolean().optional(),description:e.string().optional(),enableCors:e.boolean().optional(),corsOrigins:e.string().optional(),corsHeaders:e.string().optional(),corsMethods:e.array(e.enum(j)).optional(),corsCredentials:e.boolean().optional(),connectionConfig:C.optional()}).strict(),Ne=e.object({appName:s,instanceName:c,nameProvidedByFlag:e.boolean().optional(),instanceType:b.optional(),enableSSH:e.boolean().optional(),minCapacity:H.optional(),maxCapacity:D.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),de=e.object({appName:s,clusterName:c,serviceName:v,capacityProvider:y,containerPort:T.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),ec2Config:_.optional(),routing:e.union([M,e.array(M).min(1)]).optional(),docker:A.partial().optional(),nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),P=e.object({appName:s,computeName:c,nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),me=P.extend({type:e.literal("ecs"),cluster:U.optional(),services:e.array(B).min(1,o.SERVICE.MIN_REQUIRED),docker:A.partial().optional()}).strict().refine(n=>{const t=n.services.filter(i=>i.containers?.some(a=>a.port));return t.length>1?t.every(i=>(Array.isArray(i.routing)?i.routing:i.routing?[i.routing]:[]).some(R=>R.path||R.host)):!0},{message:o.SERVICE.ROUTING_REQUIRED}).refine(n=>{const t=n.services.map(i=>i.name);return new Set(t).size===t.length},{message:o.SERVICE.UNIQUE_WITHIN_CLUSTER}),pe=P.extend({type:e.literal("lambda"),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:G.optional(),environment:E.optional(),secrets:E.optional(),description:e.string().optional(),functionUrl:e.union([e.object({authType:e.enum(L).optional()}).strict(),e.literal(!1)]).optional(),eventSources:e.array(Y).optional()}).strict(),le=P.extend({type:e.literal("ec2"),instanceType:b.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional()}).strict(),_e=e.discriminatedUnion("type",[me,pe,le]),X=e.object({path:e.string().min(1,o.REQUIRED.ROUTING_PATH),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional()}).strict(),ye=e.object({name:e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.RESOURCE_NAME,o.RESOURCE_NAME),serviceType:e.enum(["web","worker"]).optional(),docker:A.partial().optional(),containerPort:T.optional(),needsDatabaseConnection:e.boolean().optional(),routing:e.union([X,e.array(X).min(1)]).optional()}).strict().superRefine((n,t)=>{n.serviceType==="worker"&&(n.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),n.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),be=e.object({appName:s,instanceType:e.string().optional()}).strict();export{de as AddServiceGeneratorSchema,ye as ApplicationServiceConfigSchema,X as ApplicationServiceRoutingSchema,_e as ComputeGeneratorSchema,Re as ComputeResourcePlanSchema,re as ComputeTypeSchema,ce as ContainerConfigSchema,Ne as EC2GeneratorSchema,Se as ECSGeneratorSchema,_ as Ec2ConfigSchema,y as EcsCapacityProviderSchema,U as EcsClusterConfigSchema,M as EcsRoutingConfigSchema,se as EcsScalingConfigSchema,B as EcsServiceConfigSchema,v as EcsServiceNameSchema,b as InstanceTypeSchema,Y as LambdaEventSourceSchema,ge as LambdaGeneratorSchema,N as LambdaMemorySchema,G as LambdaRuntimeSchema,be as TunnelGeneratorSchema,ae as WarmPoolSchema};
+var j=Object.defineProperty;var h=(n,t)=>j(n,"name",{value:t,configurable:!0});import{z as e}from"zod";import{VALIDATION_PATTERNS as m,VALIDATION_MESSAGES as o}from"../validation/patterns.js";import{COMPUTE_TYPES as f,ECS_CAPACITY_PROVIDERS as x,EC2_INSTANCE_TYPES as W,HTTP_METHODS as w,MIN_LAMBDA_MEMORY as V,MAX_LAMBDA_MEMORY as K,MIN_LAMBDA_TIMEOUT as S,MAX_LAMBDA_TIMEOUT as g,MIN_ECS_CAPACITY as O,MAX_ECS_CAPACITY as L,MAX_SCALING_CAPACITY as p,MAX_WARM_POOL_SIZE as F,constIncludes as Z,COMPUTE_ARCHITECTURES as z,FUNCTION_URL_AUTH_TYPES as H,DEPLOYMENT_TYPES as Q,AMI_HARDWARE_TYPES as $,LOAD_BALANCER_TYPES as q,SCALING_TYPES as J}from"./constants.js";import{validateArchitectureMatch as ee,getArchitectureForInstanceType as oe}from"./instanceTypeArchitecture.js";import{optionalOrDisabled as ne,CAPACITY_REFINEMENT as r,memoryLimitMiBSchema as I,ResourceNameSchema as c,AppNameSchema as s,PortSchema as T,ExtraPropertySchema as l,EnvironmentRecordSchema as E,SecretsImportRecordSchema as te}from"./baseSchemas.js";import{DockerBuildSchema as A}from"@fjall/util/manifest/schemas";import{EcsServiceAlarmConfigSchema as ie,LambdaAlarmConfigSchema as ae}from"./alarmSchemas.js";function re(n){return!(n.image!==void 0&&n.docker!==void 0)}h(re,"imageDockerMutexCheck");const D=e.number().int(o.CAPACITY.MIN.INTEGER).min(O,o.GENERATOR_CAPACITY.MIN.MIN).max(L,o.GENERATOR_CAPACITY.MIN.MAX),G=e.number().int(o.CAPACITY.MAX.INTEGER).min(O,o.GENERATOR_CAPACITY.MAX.MIN).max(L,o.GENERATOR_CAPACITY.MAX.MAX),N=e.number().int(o.LAMBDA.MEMORY.INTEGER).min(V,o.LAMBDA.MEMORY.MIN).max(K,o.LAMBDA.MEMORY.MAX).refine(n=>n===128||n%64===0,o.LAMBDA.MEMORY.MULTIPLE),Y=e.string().regex(m.LAMBDA_RUNTIME_IDENTIFIER,o.LAMBDA.RUNTIME),d=e.number().int(o.CPU.INTEGER).min(256,o.CPU.MIN).max(4096,o.CPU.MAX),u=e.number().int(o.CAPACITY.DESIRED.INTEGER).min(0,o.CAPACITY.DESIRED.MIN).max(p,o.CAPACITY.DESIRED.MAX),C=e.object({connectToDatabase:e.array(e.string()).optional()}).strict(),ce=e.object({minSize:e.number().int(o.CAPACITY.WARM_POOL.MIN_SIZE.INTEGER).min(0,o.CAPACITY.WARM_POOL.MIN_SIZE.MIN).max(F,o.CAPACITY.WARM_POOL.MIN_SIZE.MAX).optional(),reuseOnScaleIn:e.boolean().optional()}).strict(),_=e.object({instanceType:e.string().optional(),amiHardwareType:e.enum($).optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),memoryLimitMiB:I(128).optional(),warmPool:ce.optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(!n.instanceType||!n.amiHardwareType)return;const i=ee(n.instanceType,n.amiHardwareType);i.valid||t.addIssue({code:"custom",message:i.message??o.ARCHITECTURE_MISMATCH,path:["instanceType"]})}).superRefine((n,t)=>{n.minCapacity===0&&!n.warmPool&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL_REQUIRED,path:["minCapacity"]}),n.warmPool?.minSize!==void 0&&n.maxCapacity!==void 0&&n.warmPool.minSize>n.maxCapacity&&t.addIssue({code:"custom",message:o.CAPACITY.WARM_POOL.MIN_SIZE_EXCEEDS_MAX_CAPACITY,path:["warmPool","minSize"]})}),se=e.enum(f).describe(`Compute type must be one of: ${f.join(", ")}`),y=e.enum(x).describe(`ECS capacity provider must be one of: ${x.join(", ")}`),b=e.string().refine(n=>Z(W,n),{message:o.INSTANCE_TYPE}),v=e.object({sourceType:e.enum(["sqs","dynamodb","eventbridge"]),sourceRef:e.string().describe("Name of the source resource"),batchSize:e.number().int(o.BATCH_SIZE.INTEGER).min(1,o.BATCH_SIZE.MIN).max(1e4,o.BATCH_SIZE.MAX).optional(),startingPosition:e.enum(["TRIM_HORIZON","LATEST"]).optional(),maxBatchingWindow:e.number().int(o.BATCHING_WINDOW.INTEGER).min(0,o.BATCHING_WINDOW.MIN).max(300,o.BATCHING_WINDOW.MAX).optional(),reportBatchItemFailures:e.boolean().optional()}).strict(),me=e.object({name:e.string().min(1,o.REQUIRED.CONTAINER_NAME).optional(),image:e.string().optional(),port:T.optional(),environment:E.optional(),secretsImport:te.optional(),command:e.array(e.string()).optional(),entryPoint:e.array(e.string()).optional(),essential:e.boolean().optional(),healthCheck:e.object({command:e.array(e.string()),interval:e.number().int(o.HEALTH_CHECK.INTERVAL.INTEGER).min(5,o.HEALTH_CHECK.INTERVAL.MIN).max(300,o.HEALTH_CHECK.INTERVAL.MAX).optional(),timeout:e.number().int(o.HEALTH_CHECK.TIMEOUT.INTEGER).min(2,o.HEALTH_CHECK.TIMEOUT.MIN).max(60,o.HEALTH_CHECK.TIMEOUT.MAX).optional(),retries:e.number().int(o.HEALTH_CHECK.RETRIES.INTEGER).min(1,o.HEALTH_CHECK.RETRIES.MIN).max(10,o.HEALTH_CHECK.RETRIES.MAX).optional(),startPeriod:e.number().int(o.HEALTH_CHECK.START_PERIOD.INTEGER).min(0,o.HEALTH_CHECK.START_PERIOD.MIN).max(300,o.HEALTH_CHECK.START_PERIOD.MAX).optional()}).strict().optional(),ssmSecrets:e.array(e.string().regex(m.SECRET_NAME,o.SECRET_NAME)).optional(),extraProperties:e.array(l).optional()}).strict(),U=e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.ECS_SERVICE_NAME,o.ECS_SERVICE_NAME),B=e.object({domain:e.string().optional(),loadBalancer:e.union([e.literal(!1),e.enum(q)]).optional(),directAccess:e.boolean().optional(),extraProperties:e.array(l).optional()}).strict().refine(n=>!(n.directAccess&&n.domain),{message:o.DIRECT_ACCESS.NO_DOMAIN,path:["directAccess"]}).refine(n=>!(n.directAccess&&typeof n.loadBalancer=="string"),{message:o.DIRECT_ACCESS.NO_LOAD_BALANCER}).describe("Cluster-level configuration"),M=e.object({path:e.string().optional(),host:e.string().optional(),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional(),healthCheckPath:e.string().optional()}).strict().describe("Path/host-based routing configuration"),pe=e.object({desiredCount:u.optional(),minCapacity:e.number().int(o.CAPACITY.MIN.INTEGER).min(0,o.CAPACITY.MIN.MIN_0).max(p,o.CAPACITY.MIN.MAX).optional(),maxCapacity:e.number().int(o.CAPACITY.MAX.INTEGER).min(1,o.CAPACITY.MAX.MIN_1).max(p,o.CAPACITY.MAX.MAX).optional(),scalingType:e.enum(J).optional()}).strict().refine(r.check,r.params).describe("ECS service scaling configuration"),X=e.object({name:U,docker:A.optional(),needsDatabaseConnection:e.boolean().optional(),needsStorageConnection:e.boolean().optional(),needsMessagingConnection:e.boolean().optional(),image:e.string().optional(),containers:e.array(me).optional(),routing:e.union([M,e.array(M).min(1)]).optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),scaling:ne(pe).optional(),capacityProvider:y,ec2Config:_.optional(),ssmSecretsPath:e.string().regex(m.SSM_PATH,o.SSM_PATH).optional(),extraProperties:e.array(l).optional(),alarms:ie.optional()}).strict().superRefine((n,t)=>{re(n)||t.addIssue({code:"custom",path:["docker"],message:o.IMAGE_DOCKER_MUTEX})}).describe("Configuration for a service in an ECS cluster"),Ne=e.object({name:c,type:se,needsConnection:e.boolean(),connectedDatabase:e.array(e.string()).optional(),connectedStorage:e.array(e.string()).optional(),connectedMessaging:e.array(e.string()).optional(),cluster:B.optional(),services:e.array(X).optional(),docker:A.partial().optional(),deployment:e.enum(Q).optional(),codePath:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:Y.optional(),environment:E.optional(),secrets:E.optional(),eventSources:e.array(v).optional(),functionUrl:e.object({authType:e.enum(H)}).strict().optional(),description:e.string().optional(),scheduleExpression:e.string().optional(),architecture:e.enum(z).optional(),ephemeralStorageSize:e.number().int(o.EPHEMERAL_STORAGE.INTEGER).min(512,o.EPHEMERAL_STORAGE.MIN).max(10240,o.EPHEMERAL_STORAGE.MAX).optional(),functionName:e.string().optional(),ssmSecrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),alarms:ae.optional(),instanceType:b.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional(),variableName:e.string().optional(),extraProperties:e.array(l).optional()}).strict().superRefine((n,t)=>{if(n.type==="ecs"&&n.services)for(let i=0;i<n.services.length;i++){const a=n.services[i];a?.ec2Config?.instanceType&&!a.ec2Config.amiHardwareType&&oe(a.ec2Config.instanceType)!=="ARM"&&t.addIssue({code:"custom",message:`Service '${a.name??i}' uses instance type '${a.ec2Config.instanceType}' (x86), which requires Docker images built for linux/amd64. The default build targets linux/arm64 (Graviton). Use a Graviton instance type (t4g, c6g, r6g, m6g, etc.) or set amiHardwareType: "STANDARD" to acknowledge x86.`,path:["services",i,"ec2Config","instanceType"]})}n.type==="lambda"&&n.deployment==="container"&&n.architecture==="X86_64"&&t.addIssue({code:"custom",message:"Lambda architecture 'X86_64' requires Docker images built for linux/amd64, but the default build targets linux/arm64. Use 'ARM_64' for Graviton Lambdas (recommended) or ensure your build pipeline targets linux/amd64.",path:["architecture"]})}),de=e.object({appName:s,clusterName:c,containerPort:T,nameProvidedByFlag:e.boolean().optional(),ecrRepository:e.string().optional(),capacityProvider:y.optional(),useAppEcr:e.boolean().optional(),desiredCount:u.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),minCapacity:D.optional(),maxCapacity:G.optional(),ec2Config:_.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),_e=e.object({appName:s,functionName:c,nameProvidedByFlag:e.boolean().optional(),lambdaType:e.enum(["basic","web","custom"]).optional(),ecrRepository:e.string().optional(),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),enableFunctionUrl:e.boolean().optional(),description:e.string().optional(),enableCors:e.boolean().optional(),corsOrigins:e.string().optional(),corsHeaders:e.string().optional(),corsMethods:e.array(e.enum(w)).optional(),corsCredentials:e.boolean().optional(),connectionConfig:C.optional()}).strict(),ye=e.object({appName:s,instanceName:c,nameProvidedByFlag:e.boolean().optional(),instanceType:b.optional(),enableSSH:e.boolean().optional(),minCapacity:D.optional(),maxCapacity:G.optional(),connectionConfig:C.optional()}).strict().refine(r.check,r.params),be=e.object({appName:s,clusterName:c,serviceName:U,capacityProvider:y,containerPort:T.optional(),cpu:d.optional(),memoryLimitMiB:I(512).optional(),desiredCount:u.optional(),ec2Config:_.optional(),routing:e.union([M,e.array(M).min(1)]).optional(),docker:A.partial().optional(),nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),P=e.object({appName:s,computeName:c,nameProvidedByFlag:e.boolean().optional(),connectionConfig:C.optional()}).strict(),le=P.extend({type:e.literal("ecs"),cluster:B.optional(),services:e.array(X).min(1,o.SERVICE.MIN_REQUIRED),docker:A.partial().optional()}).strict().refine(n=>{const t=n.services.filter(i=>i.containers?.some(a=>a.port));return t.length>1?t.every(i=>(Array.isArray(i.routing)?i.routing:i.routing?[i.routing]:[]).some(R=>R.path||R.host)):!0},{message:o.SERVICE.ROUTING_REQUIRED}).refine(n=>{const t=n.services.map(i=>i.name);return new Set(t).size===t.length},{message:o.SERVICE.UNIQUE_WITHIN_CLUSTER}),Ee=P.extend({type:e.literal("lambda"),timeout:e.number().int(o.LAMBDA.TIMEOUT.INTEGER).min(S,o.LAMBDA.TIMEOUT.MIN).max(g,o.LAMBDA.TIMEOUT.MAX).optional(),memory:N.optional(),handler:e.string().optional(),runtime:Y.optional(),environment:E.optional(),secrets:E.optional(),description:e.string().optional(),functionUrl:e.union([e.object({authType:e.enum(H).optional()}).strict(),e.literal(!1)]).optional(),eventSources:e.array(v).optional()}).strict(),Ae=P.extend({type:e.literal("ec2"),instanceType:b.optional(),enableSSH:e.boolean().optional(),keyName:e.string().optional(),userData:e.string().optional(),securityGroups:e.array(e.string()).optional()}).strict(),Pe=e.discriminatedUnion("type",[le,Ee,Ae]),k=e.object({path:e.string().min(1,o.REQUIRED.ROUTING_PATH),priority:e.number().int(o.PRIORITY.INTEGER).min(1,o.PRIORITY.MIN).max(5e4,o.PRIORITY.MAX).optional()}).strict(),he=e.object({name:e.string().min(1,o.REQUIRED.SERVICE_NAME).max(255,o.MAX_LENGTH.SERVICE_NAME).regex(m.RESOURCE_NAME,o.RESOURCE_NAME),serviceType:e.enum(["web","worker"]).optional(),docker:A.partial().optional(),containerPort:T.optional(),needsDatabaseConnection:e.boolean().optional(),routing:e.union([k,e.array(k).min(1)]).optional()}).strict().superRefine((n,t)=>{n.serviceType==="worker"&&(n.containerPort!==void 0&&t.addIssue({code:"custom",path:["containerPort"],message:"Worker services are not reachable inbound; remove containerPort."}),n.routing!==void 0&&t.addIssue({code:"custom",path:["routing"],message:"Worker services have no ALB route; remove routing."}))}),fe=e.object({appName:s,instanceType:e.string().optional()}).strict();export{be as AddServiceGeneratorSchema,he as ApplicationServiceConfigSchema,k as ApplicationServiceRoutingSchema,Pe as ComputeGeneratorSchema,Ne as ComputeResourcePlanSchema,se as ComputeTypeSchema,me as ContainerConfigSchema,ye as EC2GeneratorSchema,de as ECSGeneratorSchema,_ as Ec2ConfigSchema,y as EcsCapacityProviderSchema,B as EcsClusterConfigSchema,M as EcsRoutingConfigSchema,pe as EcsScalingConfigSchema,X as EcsServiceConfigSchema,U as EcsServiceNameSchema,b as InstanceTypeSchema,v as LambdaEventSourceSchema,_e as LambdaGeneratorSchema,N as LambdaMemorySchema,Y as LambdaRuntimeSchema,fe as TunnelGeneratorSchema,ce as WarmPoolSchema};

package/dist/src/schemas/constants.js

@@ -1 +1 @@
-const a=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})});import{DATABASE_TYPES as z}from"./sharedTypes.js";const t=["ecs","lambda","ec2"],g=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),x=["code","container"],E=Object.freeze({CODE:"code",CONTAINER:"container"}),o=["ARM_64","X86_64"],l="ARM_64",T=["NONE","AWS_IAM"],A=["public","internal"],c=["CPU","MEMORY"],_=["ARM","STANDARD"],n=["Instance","Aurora"],s=["postgresql","mysql"],P=["foundation","compliance","hardened"];import{ECS_CAPACITY_PROVIDERS as q}from"./sharedTypes.js";const S="FARGATE";import{PATTERN_TYPE_VALUES as K,PATTERN_TYPES as Z,isPatternType as h,PATTERN_REGISTRY as w,DEPLOYABLE_PATTERN_TYPES as k,OPENNEXT_PATTERN_TYPES as v,isOpenNextPatternType as J}from"@fjall/util";import{APP_TYPES as $,CUSTOM_TIER as ee}from"./sharedTypes.js";const p=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],O=[0,1,5,10,15,30,60];function R(e,r){return e.includes(r)}const N=1,m=65535,C=Object.freeze({postgresql:5432,mysql:3306}),I=128,M=10240,D=1,Y=900,L=1,i=1e3,U=100,d=100,u=1,f=!1,F=3e3,B="t4g.micro",b=30,G=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],X=["standard","assets","upload","website"],H=["AES256","KMS"];import{BACKUP_VAULT_TIERS as ae}from"./sharedTypes.js";export{_ as AMI_HARDWARE_TYPES,$ as APP_TYPES,ae as BACKUP_VAULT_TIERS,o as COMPUTE_ARCHITECTURES,g as COMPUTE_TYPE,t as COMPUTE_TYPES,ee as CUSTOM_TIER,s as DATABASE_ENGINES,z as DATABASE_TYPES,a as DEFAULTS,S as DEFAULT_CAPACITY_PROVIDER,l as DEFAULT_COMPUTE_ARCHITECTURE,F as DEFAULT_CONTAINER_PORT,B as DEFAULT_EC2_INSTANCE_TYPE,b as DEFAULT_SECRET_ROTATION_DAYS,u as DEFAULT_WARM_POOL_MIN_SIZE,f as DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN,k as DEPLOYABLE_PATTERN_TYPES,E as DEPLOYMENT_TYPE,x as DEPLOYMENT_TYPES,p as EC2_INSTANCE_TYPES,q as ECS_CAPACITY_PROVIDERS,C as ENGINE_DEFAULT_DATABASE_PORTS,T as FUNCTION_URL_AUTH_TYPES,P as GOVERNANCE_PRESETS,G as HTTP_METHODS,A as LOAD_BALANCER_TYPES,i as MAX_ECS_CAPACITY,M as MAX_LAMBDA_MEMORY,Y as MAX_LAMBDA_TIMEOUT,m as MAX_PORT,U as MAX_SCALING_CAPACITY,d as MAX_WARM_POOL_SIZE,L as MIN_ECS_CAPACITY,I as MIN_LAMBDA_MEMORY,D as MIN_LAMBDA_TIMEOUT,N as MIN_PORT,v as OPENNEXT_PATTERN_TYPES,n as PATTERN_DATABASE_TYPES,w as PATTERN_REGISTRY,Z as PATTERN_TYPES,K as PATTERN_TYPE_VALUES,H as S3_ENCRYPTION_TYPES,c as SCALING_TYPES,X as STORAGE_PRESET_TYPES,O as VALID_MONITORING_INTERVALS,R as constIncludes,J as isOpenNextPatternType,h as isPatternType};
+var t=Object.defineProperty;var a=(e,r)=>t(e,"name",{value:r,configurable:!0});const x=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})});import{DATABASE_TYPES as y}from"./sharedTypes.js";const E=["ecs","lambda","ec2"],o=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),l=["code","container"],T=Object.freeze({CODE:"code",CONTAINER:"container"}),A=["ARM_64","X86_64"],c="ARM_64",_=["NONE","AWS_IAM"],n=["public","internal"],s=["CPU","MEMORY"],P=["ARM","STANDARD"],S=["Instance","Aurora"],p=["postgresql","mysql"],O=["foundation","compliance","hardened"];import{ECS_CAPACITY_PROVIDERS as Z}from"./sharedTypes.js";const R="FARGATE";import{PATTERN_TYPE_VALUES as w,PATTERN_TYPES as k,isPatternType as v,PATTERN_REGISTRY as J,DEPLOYABLE_PATTERN_TYPES as Q,OPENNEXT_PATTERN_TYPES as $,isOpenNextPatternType as ee}from"@fjall/util";import{APP_TYPES as ae,CUSTOM_TIER as te}from"./sharedTypes.js";const N=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],m=[0,1,5,10,15,30,60];function C(e,r){return e.includes(r)}a(C,"constIncludes");const I=1,M=65535,D=Object.freeze({postgresql:5432,mysql:3306}),Y=128,L=10240,i=1,U=900,d=1,u=1e3,f=100,F=100,B=1,b=!1,G=3e3,X="t4g.micro",H=30,V=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],j=["standard","assets","upload","website"],z=["AES256","KMS"];import{BACKUP_VAULT_TIERS as xe}from"./sharedTypes.js";export{P as AMI_HARDWARE_TYPES,ae as APP_TYPES,xe as BACKUP_VAULT_TIERS,A as COMPUTE_ARCHITECTURES,o as COMPUTE_TYPE,E as COMPUTE_TYPES,te as CUSTOM_TIER,p as DATABASE_ENGINES,y as DATABASE_TYPES,x as DEFAULTS,R as DEFAULT_CAPACITY_PROVIDER,c as DEFAULT_COMPUTE_ARCHITECTURE,G as DEFAULT_CONTAINER_PORT,X as DEFAULT_EC2_INSTANCE_TYPE,H as DEFAULT_SECRET_ROTATION_DAYS,B as DEFAULT_WARM_POOL_MIN_SIZE,b as DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN,Q as DEPLOYABLE_PATTERN_TYPES,T as DEPLOYMENT_TYPE,l as DEPLOYMENT_TYPES,N as EC2_INSTANCE_TYPES,Z as ECS_CAPACITY_PROVIDERS,D as ENGINE_DEFAULT_DATABASE_PORTS,_ as FUNCTION_URL_AUTH_TYPES,O as GOVERNANCE_PRESETS,V as HTTP_METHODS,n as LOAD_BALANCER_TYPES,u as MAX_ECS_CAPACITY,L as MAX_LAMBDA_MEMORY,U as MAX_LAMBDA_TIMEOUT,M as MAX_PORT,f as MAX_SCALING_CAPACITY,F as MAX_WARM_POOL_SIZE,d as MIN_ECS_CAPACITY,Y as MIN_LAMBDA_MEMORY,i as MIN_LAMBDA_TIMEOUT,I as MIN_PORT,$ as OPENNEXT_PATTERN_TYPES,S as PATTERN_DATABASE_TYPES,J as PATTERN_REGISTRY,k as PATTERN_TYPES,w as PATTERN_TYPE_VALUES,z as S3_ENCRYPTION_TYPES,s as SCALING_TYPES,j as STORAGE_PRESET_TYPES,m as VALID_MONITORING_INTERVALS,C as constIncludes,ee as isOpenNextPatternType,v as isPatternType};

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-const d="fjall.io",r="sts.amazonaws.com",g="0000000000000000000000000000000000000000";function f(e){return`FjallDevDeploy${e}`}function v(e){return`FjallDevProvisioner${e}`}function A(e){return`FjallDevSyncWriter${e}`}const D="FjallDevDeployPolicy",S="FjallDevProvisionerPolicy",R="FjallDevSyncWriterPolicy",i="FjallDevBoundary";function n(e){return`arn:aws:iam::${e}:policy/${i}`}function c(e){return`org:${e}:dev-provisioner`}function u(e){return`org:${e}:dev-sync`}function j(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a}=e,o={[`${a}:aud`]:r};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${a}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`]}}}]}function m(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${a}:aud`]:r},StringLike:{[`${a}:sub`]:`org:${l}:dev:${o}:*`}}}]}function s(e){const{providerArn:l,issuerDomain:t,sid:a,subject:o}=e;return[{Sid:a,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:r,[`${t}:sub`]:o}}}]}function E(e){return s({...e,sid:"FjallDevProvisionerSubject",subject:c(e.fjallOrgId)})}function w(e){return s({...e,sid:"FjallDevSyncSubject",subject:u(e.fjallOrgId)})}function p({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}function y({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":n(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}function b({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}function P({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}export{i as DEV_BOUNDARY_POLICY_NAME,D as DEV_DEPLOY_POLICY_NAME,S as DEV_PROVISIONER_POLICY_NAME,R as DEV_SYNC_WRITER_POLICY_NAME,r as FJALL_OIDC_AUDIENCE,d as FJALL_OIDC_ISSUER_DOMAIN,g as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,P as buildDevBoundaryStatements,p as buildDevDeployPolicyStatements,m as buildDevDeployTrustStatements,y as buildDevProvisionerPolicyStatements,E as buildDevProvisionerTrustStatements,b as buildDevSyncWriterPolicyStatements,w as buildDevSyncWriterTrustStatements,j as buildNarrowedDeployTrustStatements,n as devBoundaryPolicyArn,f as devDeployRoleName,v as devProvisionerRoleName,c as devProvisionerSubject,u as devSyncSubject,A as devSyncWriterRoleName};
+var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",s="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function S(e){return`FjallDevDeploy${e}`}a(S,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",E="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function w(e){const{fjallOrgId:l,providerArn:o,issuerDomain:t}=e,r={[`${t}:aud`]:s};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:r,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`]}}}]}a(w,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:o,issuerDomain:t,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:s},StringLike:{[`${t}:sub`]:`org:${l}:dev:${r}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:o,sid:t,subject:r}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${o}:aud`]:s,[`${o}:sub`]:r}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,E as DEV_SYNC_WRITER_POLICY_NAME,s as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,w as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,S as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};

package/dist/src/schemas/instanceTypeArchitecture.js

@@ -1 +1 @@
-const g=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","m6g","m6gd","m7g","m7gd","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function r(t){const e=t.split(".")[0]??"";return g.has(e)?"ARM":"STANDARD"}function i(t,e){const c=r(t);return c!==e?{valid:!1,message:`Instance type '${t}' requires ${c} architecture, but '${e}' AMI was specified. Use a ${c==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}function s(t,e){return r(t)===e}export{r as getArchitectureForInstanceType,s as isArchitectureCompatible,i as validateArchitectureMatch};
+var n=Object.defineProperty;var c=(t,e)=>n(t,"name",{value:e,configurable:!0});const i=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","m6g","m6gd","m7g","m7gd","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function g(t){const e=t.split(".")[0]??"";return i.has(e)?"ARM":"STANDARD"}c(g,"getArchitectureForInstanceType");function a(t,e){const r=g(t);return r!==e?{valid:!1,message:`Instance type '${t}' requires ${r} architecture, but '${e}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}c(a,"validateArchitectureMatch");function o(t,e){return g(t)===e}c(o,"isArchitectureCompatible");export{g as getArchitectureForInstanceType,o as isArchitectureCompatible,a as validateArchitectureMatch};

package/dist/src/schemas/securityBoundary.js

@@ -1 +1 @@
-function t(c){return`FjallDeployBoundary${c}`}const e={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},n=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],o=[...n,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],i=[...o,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],a={foundation:[e,...n],compliance:[e,...o],hardened:[e,...i]};export{a as SECURITY_TIER_TO_BOUNDARY,t as deployBoundaryName};
+var a=Object.defineProperty;var o=(e,t)=>a(e,"name",{value:t,configurable:!0});function r(e){return`FjallDeployBoundary${e}`}o(r,"deployBoundaryName");const n={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},c=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],i=[...c,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],l=[...i,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],D={foundation:[n,...c],compliance:[n,...i],hardened:[n,...l]};export{D as SECURITY_TIER_TO_BOUNDARY,r as deployBoundaryName};

package/dist/src/types/Result.js

@@ -1 +1 @@
-import{normaliseError as e}from"../util/errorUtils.js";function u(r){return r.success===!0}function o(r){return r.success===!1}function c(r){return{success:!0,data:r}}function n(r){return{success:!1,error:r}}async function a(r){try{const t=await r();return c(t)}catch(t){return n(e(t))}}function i(r){try{const t=r();return c(t)}catch(t){return n(e(t))}}export{n as failure,o as isFailure,u as isSuccess,c as success,a as tryAsync,i as trySync};
+var u=Object.defineProperty;var e=(r,t)=>u(r,"name",{value:t,configurable:!0});import{normaliseError as c}from"../util/errorUtils.js";function i(r){return r.success===!0}e(i,"isSuccess");function f(r){return r.success===!1}e(f,"isFailure");function n(r){return{success:!0,data:r}}e(n,"success");function s(r){return{success:!1,error:r}}e(s,"failure");async function p(r){try{const t=await r();return n(t)}catch(t){return s(c(t))}}e(p,"tryAsync");function y(r){try{const t=r();return n(t)}catch(t){return s(c(t))}}e(y,"trySync");export{s as failure,f as isFailure,i as isSuccess,n as success,p as tryAsync,y as trySync};

package/dist/src/validation/validationPatterns.js

@@ -1 +1 @@
-import{SECRET_NAME_PATTERN as s,SSM_COMPONENT_PATTERN as A}from"@fjall/util";const _=/^[a-zA-Z][a-zA-Z0-9-]*$/,u=A.source.replace(/^\^|\$$/g,""),i=Object.freeze({IDENTIFIER:_,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:_,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${u})+$`),SECRET_NAME:s,SSM_COMPONENT:A,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function z(t){const a=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(t);if(!a)return;const n=a[1],e=a[2];if(n===void 0||e===void 0)return;const E=parseInt(n,10);if(!Number.isFinite(E)||E<1)return;const r=e==="minute"||e==="hour"||e==="day";if(!(r&&E!==1)&&!(!r&&E===1))return e==="minute"||e==="minutes"?{everyMs:E*6e4}:e==="hour"||e==="hours"?{everyMs:E*60*6e4}:{everyMs:E*24*60*6e4}}export{i as VALIDATION_PATTERNS,z as parseRateExpression};
+var u=Object.defineProperty;var _=(n,a)=>u(n,"name",{value:a,configurable:!0});import{SECRET_NAME_PATTERN as d,SSM_COMPONENT_PATTERN as t}from"@fjall/util";const s=/^[a-zA-Z][a-zA-Z0-9-]*$/,i=t.source.replace(/^\^|\$$/g,""),T=Object.freeze({IDENTIFIER:s,NEW_APP_NAME:/^[a-z][a-z0-9-]*$/,RESOURCE_NAME:/^[a-zA-Z][a-zA-Z0-9]*$/,ECS_SERVICE_NAME:s,BUCKET_NAME:/^[a-z][a-z0-9-]*[a-z0-9]$|^[a-z][a-z0-9]*$/,DATABASE_NAME:/^[a-zA-Z][a-zA-Z0-9_]*$/,RESOURCE_TYPE:/^[a-z]+(:[a-z]+)?$/,SSM_PATH:new RegExp(`^(?:/${i})+$`),SECRET_NAME:d,SSM_COMPONENT:t,EMAIL:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,DOCKER_IMAGE:/^[a-z0-9][a-z0-9._-]*[a-z0-9](:[a-z0-9._-]+)?$/,DOMAIN:/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/i,HTTP_ORIGIN:/^https?:\/\/[a-z0-9.-]+(:\d+)?$/i,PASCAL_CASE:/^[A-Z][A-Za-z0-9]*$/,AWS_ACCOUNT_ID:/^\d{12}$/,VPC_ID:/^vpc-[a-z0-9]+$/,ROLE_ARN:/^arn:aws[a-zA-Z-]*:iam::\d{12}:role\/.+$/,CIDR:/^((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\/(3[0-2]|[12]?\d)$/,SCHEDULE_EXPRESSION:/^(rate\(1 (?:minute|hour|day)\)|rate\((?:[2-9]|[1-9]\d+) (?:minutes|hours|days)\)|cron\([^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+ [^\s()]+\))$/,LAMBDA_RUNTIME_IDENTIFIER:/^[A-Za-z0-9._-]+$/,ENV_VAR_NAME:/^[A-Za-z_][A-Za-z0-9_]*$/});function o(n){const a=/^rate\((\d+) (minute|minutes|hour|hours|day|days)\)$/.exec(n);if(!a)return;const r=a[1],e=a[2];if(r===void 0||e===void 0)return;const E=parseInt(r,10);if(!Number.isFinite(E)||E<1)return;const A=e==="minute"||e==="hour"||e==="day";if(!(A&&E!==1)&&!(!A&&E===1))return e==="minute"||e==="minutes"?{everyMs:E*6e4}:e==="hour"||e==="hours"?{everyMs:E*60*6e4}:{everyMs:E*24*60*6e4}}_(o,"parseRateExpression");export{T as VALIDATION_PATTERNS,o as parseRateExpression};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "2.34.0";
+export declare const GENERATOR_VERSION = "3.1.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="2.34.0";export{E as GENERATOR_VERSION};
+const E="3.1.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "2.34.0",
+  "version": "3.1.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^2.34.0",
+    "@fjall/util": "^3.1.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "8c553fca8f9737d445061ea75cf6c6c7db0d24c9"
+  "gitHead": "0f27cc5e260fdf218d33de546ba8610be89e1d81"
 }