@fjall/generator 3.4.1 → 3.6.0

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-18T23:08:25.787Z
+146 files minified at 2026-07-19T21:13:14.544Z

package/dist/src/ast/domain/astDomainParser.d.ts

@@ -62,6 +62,13 @@ export interface ParsedCertificateFromAst {
     readonly domainName: string;
     readonly subjectAlternativeNames?: string[];
     readonly transparencyLogging?: boolean;
+    /**
+     * D3 CloudFront viewer-certificate designation. Parsed fail-closed: a
+     * present-but-dynamic value is refused rather than dropped — silently
+     * losing it would strip the zone-level us-east-1 export contract on an
+     * import/eject round trip.
+     */
+    readonly cloudFront?: boolean;
 }
 interface ParsedDomainCommon {
     readonly zoneName: string;
@@ -78,6 +85,17 @@ export interface ParsedRoute53ApexDomainProps extends ParsedDomainCommon {
 export interface ParsedExternalDelegatedDomainProps extends ParsedDomainCommon {
     readonly registrar: "external-delegated";
     readonly delegatedSubdomain: string;
+    /**
+     * Child-zone ADOPTION: hosted zone id of an EXISTING delegated zone.
+     * Both-or-neither with `adoptedNameServers` (validated here fail-closed —
+     * a one-sided declaration must never survive an import/eject round trip).
+     */
+    readonly hostedZoneId: string | undefined;
+    /**
+     * Literal NS hostnames of the adopted zone — the parent NS UPSERT carries
+     * them verbatim because an imported zone exposes no NS attribute at synth.
+     */
+    readonly adoptedNameServers: string[] | undefined;
     /**
      * D8 child-writes delegation: LITERAL parent DelegationRole ARN, when the
      * source declares one. `undefined` when absent (the CLI injects it at

package/dist/src/ast/domain/astDomainParser.js

@@ -1 +1 @@
-var D=Object.defineProperty;var a=(e,n)=>D(e,"name",{value:n,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as R,asString as c,asStringUnion as h,asStringArray as k,asBoolean as T,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as u}from"../../types/Result.js";import{DnsRecordTypeSchema as I}from"../../dns/types.js";import{DomainRegistrarSchema as v,DomainDeployPhaseSchema as L,AliasRecordTypeSchema as j,TYPED_FJALL_TARGET_KINDS as O}from"../../dns/domainRecords.js";const A=v.options,S=L.options,C=I.options,V=j.options;function ne(e){const n=[],t=a(i=>{if(m.isNewExpression(i)&&P(i.expression)){const o=Z(i);o!==void 0&&n.push(o)}m.forEachChild(i,t)},"visit");if(t(e),n.length===0)return l(void 0);if(n.length>1)return u(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${n.length}`));const r=n[0];return r?l(r):l(void 0)}a(ne,"findDomainConstructCall");function P(e){return m.isIdentifier(e)&&e.text==="Domain"}a(P,"isDomainIdentifier");function Z(e){const n=e.arguments;if(!n||n.length<3)return;const t=n[0],r=n[1],i=n[2];if(!t||!r||!i||!m.isObjectLiteralExpression(i))return;const o=z(e);if(o===void 0)return;const d=M(e),s=m.isStringLiteral(r)?r.text:void 0;return{callExpression:e,containingStatement:o,propsObjectLiteral:i,domainVarId:d,scopeArgumentText:t.getText(),constructIdLiteral:s}}a(Z,"buildMatch");function z(e){let n=e;for(;n!==void 0;){if(m.isExpressionStatement(n)||m.isVariableStatement(n))return n;n=n.parent}}a(z,"findContainingTopLevelStatement");function M(e){let n=e.parent;for(;n!==void 0;){if(m.isVariableDeclaration(n)&&m.isIdentifier(n.name)&&n.initializer===e)return n.name.text;n=n.parent}}a(M,"extractDomainVarId");function q(e){switch(e.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${A.join(", ")}, got ${JSON.stringify(e.value)}`;case"missing_field":return`'${e.field}' property is required`;case"invalid_literal":return`'${e.field}' ${e.reason}`;case"removed_field":return`'${e.field}' was removed from the Domain API \u2014 ${e.cure}`}}a(q,"errorMessage");const B="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function te(e){const n=R(e),t=h(n.registrar,A);if(t===void 0){const s=n.registrar;if(s===void 0)return u({kind:"registrar_required"});const f=typeof s=="string"?s:_(s);return u({kind:"registrar_unsupported",value:f})}const r=c(n.zoneName);if(r===void 0)return u({kind:"missing_field",field:"zoneName"});const i=J(n.records);if(!i.success)return i;const o=H(n.certificates);if(!o.success)return o;if(n.delegations!==void 0)return u({kind:"removed_field",field:"delegations",cure:B});const d={zoneName:r,description:c(n.description),costAllocationEnvironment:c(n.costAllocationEnvironment),tags:K(n.tags),records:i.data,certificates:o.data};switch(t){case"route53":return l({...d,registrar:t,hostedZoneId:c(n.hostedZoneId)});case"external-delegated":{const s=c(n.delegatedSubdomain);if(s===void 0)return u({kind:"missing_field",field:"delegatedSubdomain"});const f=c(n.parentDelegationRoleArn);if(n.parentDelegationRoleArn!==void 0&&f===void 0)return u({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const y=h(n.phase,S);return n.phase!==void 0&&y===void 0?u({kind:"invalid_literal",field:"phase",reason:`must be one of ${S.map(N=>`'${N}'`).join(", ")}`}):l({...d,registrar:t,delegatedSubdomain:s,parentDelegationRoleArn:f,phase:y})}case"external-records":return l({...d,registrar:t})}}a(te,"parseDomainProps");function ie(e){return q(e)}a(ie,"parseDomainErrorMessage");function J(e){if(e===void 0)return l([]);if(!Array.isArray(e))return u({kind:"invalid_literal",field:"records",reason:"must be an array"});const n=[];for(let t=0;t<e.length;t++){const r=e[t];if(!g(r))return u({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const i=F(r,t);if(!i.success)return i;n.push(i.data)}return l(n)}a(J,"parseRecordsArray");function F(e,n){const t=c(e.type),r=c(e.name);if(t===void 0)return u({kind:"missing_field",field:`records[${n}].type`});if(r===void 0)return u({kind:"missing_field",field:`records[${n}].name`});if(e.target!==void 0){if(!V.some(f=>f===t))return u({kind:"invalid_literal",field:`records[${n}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=U(e.target);return l({kind:"alias",type:t,name:r,target:s})}if(!C.some(s=>s===t))return u({kind:"invalid_literal",field:`records[${n}]`,reason:`unsupported record type '${t}'`});const i=G(e.value);if(i===void 0)return u({kind:"invalid_literal",field:`records[${n}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(e.value)})`});const o=$(e.ttl),d={kind:"standard",type:t,name:r,value:i,...o!==void 0?{ttl:o}:{}};return l(d)}a(F,"parseRecord");function G(e){if(e===void 0)return;if(typeof e=="string")return e;const n=k(e);if(n!==void 0)return n}a(G,"parseRecordValue");function U(e){if(E(e))return Y(e);if(g(e)){const n=h(e.kind,O);if(n==="ecs"||n==="cdn"){const t=c(e.appName);if(t!==void 0)return{kind:n,appName:t}}if(n==="bucket"){const t=c(e.bucketName);if(t!==void 0)return{kind:n,bucketName:t}}if(n==="custom"){const t=c(e.dnsName),r=c(e.hostedZoneId);if(t!==void 0&&r!==void 0)return{kind:n,dnsName:t,hostedZoneId:r}}}return{kind:"unresolved",sourceText:_(e)}}a(U,"parseTarget");function Y(e){const n=e.__call.trim(),t=n.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:n};const r=t[1],i=t[2]??"",o=b(i);switch(r){case"fjallApp":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"ecs",appName:d}}case"fjallCdn":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"cdn",appName:d}}case"fjallBucket":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"bucket",bucketName:d}}case"aliasTo":{if(o.length>=2){const d=p(o,0),s=p(o,1);return d!==void 0&&s!==void 0?{kind:"custom",dnsName:d,hostedZoneId:s}:{kind:"dynamic",sourceText:n}}if(o.length===1){const d=o[0]?.trim()??"",s=x(d,"dnsName"),f=x(d,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:n}}return{kind:"unresolved",sourceText:n}}default:return{kind:"unresolved",sourceText:n}}}a(Y,"resolveCallRefTarget");function b(e){const n=[];let t=0,r=null,i="";for(let d=0;d<e.length;d++){const s=e[d];if(r!==null){if(i+=s,s==="\\"&&d+1<e.length){const f=e[d+1];f!==void 0&&(i+=f,d+=1);continue}s===r&&(r=null);continue}if(s==='"'||s==="'"||s==="`"){r=s,i+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,i+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,i+=s;continue}if(s===","&&t===0){n.push(i.trim()),i="";continue}i+=s}const o=i.trim();return o.length>0&&n.push(o),n}a(b,"splitTopLevelArgs");function p(e,n){const t=e[n];if(t===void 0)return;const r=t.trim();if(r.length<2)return;const i=r[0],o=r[r.length-1];if(i===o&&!(i!=='"'&&i!=="'"&&i!=="`"))return r.slice(1,-1)}a(p,"extractStringLiteralArg");function x(e,n){const t=e.trim().replace(/^\{|\}$/g,""),r=b(t);for(const i of r){const o=i.indexOf(":");if(o<0||i.slice(0,o).trim().replace(/["'`]/g,"")!==n)continue;const s=i.slice(o+1).trim();return p([s],0)}}a(x,"extractObjectFieldString");function H(e){if(e===void 0)return l([]);if(!Array.isArray(e))return u({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const n=[];for(let t=0;t<e.length;t++){const r=e[t];if(typeof r=="string"){n.push({domainName:r});continue}if(!g(r))return u({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const i=c(r.domainName);if(i===void 0)return u({kind:"missing_field",field:`certificates[${t}].domainName`});const o=k(r.subjectAlternativeNames),d=T(r.transparencyLogging);n.push({domainName:i,...o!==void 0?{subjectAlternativeNames:o}:{},...d!==void 0?{transparencyLogging:d}:{}})}return l(n)}a(H,"parseCertificatesArray");function K(e){if(e===void 0||!g(e))return;const n={};for(const[t,r]of Object.entries(e)){const i=c(r);i!==void 0&&(n[t]=i)}return Object.keys(n).length===0?void 0:n}a(K,"parseStringRecord");function _(e){if(e===void 0)return"undefined";if(e===null)return"null";if(typeof e=="string")return JSON.stringify(e);if(typeof e=="number"||typeof e=="boolean")return String(e);if(Array.isArray(e))return`[${e.map(n=>_(n)).join(", ")}]`;if(typeof e=="object"){if("__call"in e)return String(e.__call);if("__identifier"in e)return String(e.__identifier);if("__expression"in e)return String(e.__expression);if("__unknown"in e)return String(e.__unknown)}return String(e)}a(_,"stringifyParsedValue");export{ne as findDomainConstructCall,ie as parseDomainErrorMessage,te as parseDomainProps,b as splitTopLevelArgs};
+var R=Object.defineProperty;var u=(n,e)=>R(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as T,asString as c,asStringUnion as _,asStringArray as y,asBoolean as b,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as L}from"../../dns/types.js";import{DomainRegistrarSchema as j,DomainDeployPhaseSchema as Z,AliasRecordTypeSchema as O,TYPED_FJALL_TARGET_KINDS as C}from"../../dns/domainRecords.js";const N=j.options,x=Z.options,P=L.options,V=O.options;function ie(n){const e=[],t=u(i=>{if(m.isNewExpression(i)&&z(i.expression)){const d=F(i);d!==void 0&&e.push(d)}m.forEachChild(i,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const r=e[0];return r?l(r):l(void 0)}u(ie,"findDomainConstructCall");function z(n){return m.isIdentifier(n)&&n.text==="Domain"}u(z,"isDomainIdentifier");function F(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],r=e[1],i=e[2];if(!t||!r||!i||!m.isObjectLiteralExpression(i))return;const d=M(n);if(d===void 0)return;const o=q(n),s=m.isStringLiteral(r)?r.text:void 0;return{callExpression:n,containingStatement:d,propsObjectLiteral:i,domainVarId:o,scopeArgumentText:t.getText(),constructIdLiteral:s}}u(F,"buildMatch");function M(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(M,"findContainingTopLevelStatement");function q(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(q,"extractDomainVarId");function B(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${N.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(B,"errorMessage");const J="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function re(n){const e=T(n),t=_(e.registrar,N);if(t===void 0){const s=e.registrar;if(s===void 0)return a({kind:"registrar_required"});const f=typeof s=="string"?s:k(s);return a({kind:"registrar_unsupported",value:f})}const r=c(e.zoneName);if(r===void 0)return a({kind:"missing_field",field:"zoneName"});const i=U(e.records);if(!i.success)return i;const d=Q(e.certificates);if(!d.success)return d;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:J});const o={zoneName:r,description:c(e.description),costAllocationEnvironment:c(e.costAllocationEnvironment),tags:W(e.tags),records:i.data,certificates:d.data};switch(t){case"route53":return l({...o,registrar:t,hostedZoneId:c(e.hostedZoneId)});case"external-delegated":{const s=c(e.delegatedSubdomain);if(s===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const f=c(e.hostedZoneId);if(e.hostedZoneId!==void 0&&f===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const h=y(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&h===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(f===void 0!=(h===void 0))return a({kind:"invalid_literal",field:f===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const S=c(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&S===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const A=_(e.phase,x);return e.phase!==void 0&&A===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${x.map(I=>`'${I}'`).join(", ")}`}):l({...o,registrar:t,delegatedSubdomain:s,hostedZoneId:f,adoptedNameServers:h,parentDelegationRoleArn:S,phase:A})}case"external-records":return l({...o,registrar:t})}}u(re,"parseDomainProps");function se(n){return B(n)}u(se,"parseDomainErrorMessage");function U(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(!g(r))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const i=G(r,t);if(!i.success)return i;e.push(i.data)}return l(e)}u(U,"parseRecordsArray");function G(n,e){const t=c(n.type),r=c(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(r===void 0)return a({kind:"missing_field",field:`records[${e}].name`});if(n.target!==void 0){if(!V.some(f=>f===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=H(n.target);return l({kind:"alias",type:t,name:r,target:s})}if(!P.some(s=>s===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const i=Y(n.value);if(i===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const d=$(n.ttl),o={kind:"standard",type:t,name:r,value:i,...d!==void 0?{ttl:d}:{}};return l(o)}u(G,"parseRecord");function Y(n){if(n===void 0)return;if(typeof n=="string")return n;const e=y(n);if(e!==void 0)return e}u(Y,"parseRecordValue");function H(n){if(E(n))return K(n);if(g(n)){const e=_(n.kind,C);if(e==="ecs"||e==="cdn"){const t=c(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=c(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=c(n.dnsName),r=c(n.hostedZoneId);if(t!==void 0&&r!==void 0)return{kind:e,dnsName:t,hostedZoneId:r}}}return{kind:"unresolved",sourceText:k(n)}}u(H,"parseTarget");function K(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const r=t[1],i=t[2]??"",d=v(i);switch(r){case"fjallApp":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:o}}case"fjallCdn":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:o}}case"fjallBucket":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:o}}case"aliasTo":{if(d.length>=2){const o=p(d,0),s=p(d,1);return o!==void 0&&s!==void 0?{kind:"custom",dnsName:o,hostedZoneId:s}:{kind:"dynamic",sourceText:e}}if(d.length===1){const o=d[0]?.trim()??"",s=D(o,"dnsName"),f=D(o,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(K,"resolveCallRefTarget");function v(n){const e=[];let t=0,r=null,i="";for(let o=0;o<n.length;o++){const s=n[o];if(r!==null){if(i+=s,s==="\\"&&o+1<n.length){const f=n[o+1];f!==void 0&&(i+=f,o+=1);continue}s===r&&(r=null);continue}if(s==='"'||s==="'"||s==="`"){r=s,i+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,i+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,i+=s;continue}if(s===","&&t===0){e.push(i.trim()),i="";continue}i+=s}const d=i.trim();return d.length>0&&e.push(d),e}u(v,"splitTopLevelArgs");function p(n,e){const t=n[e];if(t===void 0)return;const r=t.trim();if(r.length<2)return;const i=r[0],d=r[r.length-1];if(i===d&&!(i!=='"'&&i!=="'"&&i!=="`"))return r.slice(1,-1)}u(p,"extractStringLiteralArg");function D(n,e){const t=n.trim().replace(/^\{|\}$/g,""),r=v(t);for(const i of r){const d=i.indexOf(":");if(d<0||i.slice(0,d).trim().replace(/["'`]/g,"")!==e)continue;const s=i.slice(d+1).trim();return p([s],0)}}u(D,"extractObjectFieldString");function Q(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(typeof r=="string"){e.push({domainName:r});continue}if(!g(r))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const i=c(r.domainName);if(i===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const d=y(r.subjectAlternativeNames),o=b(r.transparencyLogging),s=b(r.cloudFront);if(r.cloudFront!==void 0&&s===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:i,...d!==void 0?{subjectAlternativeNames:d}:{},...o!==void 0?{transparencyLogging:o}:{},...s!==void 0?{cloudFront:s}:{}})}return l(e)}u(Q,"parseCertificatesArray");function W(n){if(n===void 0||!g(n))return;const e={};for(const[t,r]of Object.entries(n)){const i=c(r);i!==void 0&&(e[t]=i)}return Object.keys(e).length===0?void 0:e}u(W,"parseStringRecord");function k(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>k(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(k,"stringifyParsedValue");export{ie as findDomainConstructCall,se as parseDomainErrorMessage,re as parseDomainProps,v as splitTopLevelArgs};

package/dist/src/dns/domainFileGenerator.js

@@ -1,7 +1,7 @@
-var m=Object.defineProperty;var r=(a,e)=>m(a,"name",{value:e,configurable:!0});import{toPascalCase as p}from"../generation/common.js";import{GENERATOR_VERSION as i}from"../version.js";function D(a){const{domainName:e,hostedZoneId:o,records:n=[]}=a,t=`fjall/domains/${e}`;return[{path:`${t}/infrastructure.ts`,content:w({domainName:e,records:n,hostedZoneId:o})},{path:`${t}/package.json`,content:f(e)},{path:`${t}/tsconfig.json`,content:g},{path:`${t}/cdk.json`,content:y},{path:`${t}/.gitignore`,content:k}]}r(D,"generateDomainFiles");function w(a){const{domainName:e,records:o,hostedZoneId:n}=a,t=p(e.split(".").join("")),c=o.map(s=>{const l=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${l} },`}),u=c.length>0?`[
-${c.join(`
+var p=Object.defineProperty;var r=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as w}from"@fjall/util";import{toPascalCase as f}from"../generation/common.js";import{GENERATOR_VERSION as u}from"../version.js";function j(t){const{domainName:e,hostedZoneId:o,records:n=[]}=t,a=`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:k({domainName:e,records:n,hostedZoneId:o})},{path:`${a}/package.json`,content:g(e)},{path:`${a}/tsconfig.json`,content:S},{path:`${a}/cdk.json`,content:N},{path:`${a}/.gitignore`,content:y}]}r(j,"generateDomainFiles");function k(t){const{domainName:e,records:o,hostedZoneId:n}=t,a=f(e.split(".").join("")),c=w(e),i=o.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),d=i.length>0?`[
+${i.join(`
 `)}
-  ]`:"[]",d=n?`  hostedZoneId: ${JSON.stringify(n)},
+  ]`:"[]",l=n?`  hostedZoneId: ${JSON.stringify(n)},
 `:"";return`import {
   App,
   Domain,
@@ -10,27 +10,29 @@ ${c.join(`
 // Fjall-managed domain \u2014 edit this file to add or change records.
 // See https://docs.fjall.io/resources/networking/domain for the Domain construct API.
 
-const app = App.getApp(${JSON.stringify(`${t}Domain`)});
+const app = App.getApp(${JSON.stringify(c)});
 
 // Stack name must equal getDomainStackName(${JSON.stringify(e)}) \u2014 the CLI's
 // deploy record and ManagedDomainBinding resolution both DescribeStacks by it.
-const stack = app.getStack(${JSON.stringify(`${t}Domain`)}).getStack();
+const stack = app.getStack(${JSON.stringify(c)}).getStack();
 
-new Domain(stack, ${JSON.stringify(t)}, {
+new Domain(stack, ${JSON.stringify(a)}, {
   registrar: "route53",
   zoneName: ${JSON.stringify(e)},
-${d}  certificates: [
+${l}  certificates: [
     { domainName: ${JSON.stringify(e)} },
   ],
-  records: ${u},
+  records: ${d},
 });
-`}r(w,"generateDefaultInfrastructureTs");function f(a){return JSON.stringify({name:`domain-${a}`,version:i,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${i}`,"aws-cdk-lib":"^2.260.0",constructs:"^10.6.0"}},null,2)+`
-`}r(f,"generateDomainPackageJson");const k=`node_modules/
+`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.260.0",constructs:"^10.6.0"}},null,2)+`
+`}r(g,"generateDomainPackageJson");const y=`node_modules/
 cdk.out/
 *.d.ts
 *.js
+.fjall-state*.json
+.fjall-state*.json.tmp
 .deploy-state.json
 .deploy-state.json.tmp
-`,g=JSON.stringify({compilerOptions:{target:"ES2020",module:"commonjs",lib:["es2020","dom"],declaration:!0,strict:!0,noImplicitAny:!0,strictNullChecks:!0,noImplicitThis:!0,alwaysStrict:!0,noUnusedLocals:!1,noUnusedParameters:!1,noImplicitReturns:!0,noFallthroughCasesInSwitch:!1,inlineSourceMap:!0,inlineSources:!0,experimentalDecorators:!0,strictPropertyInitialization:!1,typeRoots:["./node_modules/@types"]},exclude:["node_modules","cdk.out"]},null,2)+`
-`,y=JSON.stringify({app:"npx ts-node --prefer-ts-exts --transpile-only infrastructure.ts",assetMetadata:!1,pathMetadata:!1,versionReporting:!1,watch:{include:["**"],exclude:["README.md","cdk*.json","**/*.d.ts","**/*.js","tsconfig.json","package*.json","yarn.lock","node_modules","test"]},context:{"@aws-cdk/aws-lambda:recognizeLayerVersion":!0,"@aws-cdk/core:checkSecretUsage":!0,"@aws-cdk/core:target-partitions":["aws","aws-cn"],"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver":!0,"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName":!0,"@aws-cdk/aws-ecs:arnFormatIncludesClusterName":!0,"@aws-cdk/aws-iam:minimizePolicies":!0,"@aws-cdk/core:validateSnapshotRemovalPolicy":!0,"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName":!0,"@aws-cdk/aws-s3:createDefaultLoggingPolicy":!0,"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":!0,"@aws-cdk/aws-apigateway:disableCloudWatchRole":!0,"@aws-cdk/core:enablePartitionLiterals":!0,"@aws-cdk/aws-events:eventsTargetQueueSameAccount":!0,"@aws-cdk/aws-iam:standardizedServicePrincipals":!0,"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":!0,"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName":!0,"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":!0,"@aws-cdk/aws-route53-patters:useCertificate":!0,"@aws-cdk/customresources:installLatestAwsSdkDefault":!1,"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":!0,"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup":!0,"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId":!0,"@aws-cdk/aws-ec2:launchTemplateDefaultUserData":!0,"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments":!0,"@aws-cdk/aws-redshift:columnId":!0,"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":!0,"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup":!0,"@aws-cdk/aws-apigateway:requestValidatorUniqueId":!0,"@aws-cdk/aws-kms:aliasNameRef":!0,"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig":!0,"@aws-cdk/core:includePrefixInUniqueNameGeneration":!0,"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby":!0}},null,2)+`
-`;export{D as generateDomainFiles};
+`,S=JSON.stringify({compilerOptions:{target:"ES2020",module:"commonjs",lib:["es2020","dom"],declaration:!0,strict:!0,noImplicitAny:!0,strictNullChecks:!0,noImplicitThis:!0,alwaysStrict:!0,noUnusedLocals:!1,noUnusedParameters:!1,noImplicitReturns:!0,noFallthroughCasesInSwitch:!1,inlineSourceMap:!0,inlineSources:!0,experimentalDecorators:!0,strictPropertyInitialization:!1,typeRoots:["./node_modules/@types"]},exclude:["node_modules","cdk.out"]},null,2)+`
+`,N=JSON.stringify({app:"npx ts-node --prefer-ts-exts --transpile-only infrastructure.ts",assetMetadata:!1,pathMetadata:!1,versionReporting:!1,watch:{include:["**"],exclude:["README.md","cdk*.json","**/*.d.ts","**/*.js","tsconfig.json","package*.json","yarn.lock","node_modules","test"]},context:{"@aws-cdk/aws-lambda:recognizeLayerVersion":!0,"@aws-cdk/core:checkSecretUsage":!0,"@aws-cdk/core:target-partitions":["aws","aws-cn"],"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver":!0,"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName":!0,"@aws-cdk/aws-ecs:arnFormatIncludesClusterName":!0,"@aws-cdk/aws-iam:minimizePolicies":!0,"@aws-cdk/core:validateSnapshotRemovalPolicy":!0,"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName":!0,"@aws-cdk/aws-s3:createDefaultLoggingPolicy":!0,"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":!0,"@aws-cdk/aws-apigateway:disableCloudWatchRole":!0,"@aws-cdk/core:enablePartitionLiterals":!0,"@aws-cdk/aws-events:eventsTargetQueueSameAccount":!0,"@aws-cdk/aws-iam:standardizedServicePrincipals":!0,"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":!0,"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName":!0,"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":!0,"@aws-cdk/aws-route53-patters:useCertificate":!0,"@aws-cdk/customresources:installLatestAwsSdkDefault":!1,"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":!0,"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup":!0,"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId":!0,"@aws-cdk/aws-ec2:launchTemplateDefaultUserData":!0,"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments":!0,"@aws-cdk/aws-redshift:columnId":!0,"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":!0,"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup":!0,"@aws-cdk/aws-apigateway:requestValidatorUniqueId":!0,"@aws-cdk/aws-kms:aliasNameRef":!0,"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig":!0,"@aws-cdk/core:includePrefixInUniqueNameGeneration":!0,"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby":!0}},null,2)+`
+`;export{j as generateDomainFiles};

package/dist/src/dns/domainRecords.d.ts

@@ -29,7 +29,10 @@ export type DomainRegistrar = z.infer<typeof DomainRegistrarSchema>;
  * R2 two-step deploy gate on the delegated-child Domain topology (D8):
  * `"zone"` synthesises the child zone + delegation record + records only;
  * `"full"` (the construct default) additionally issues certificates.
- * Mirrors `DomainDeployPhase` in @fjall/components-infrastructure.
+ * Mirrors `DomainDeployPhase`, homed in @fjall/util (re-exported by
+ * @fjall/components-infrastructure and @fjall/deploy-core). Kept as an
+ * independent zod enum: generator's parsers validate untrusted source text,
+ * so the schema is the contract here, not the type.
  */
 export declare const DomainDeployPhaseSchema: z.ZodEnum<{
     zone: "zone";
@@ -115,6 +118,7 @@ export declare const ParsedCertificateSchema: z.ZodObject<{
     domainName: z.ZodString;
     subjectAlternativeNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
     transparencyLogging: z.ZodOptional<z.ZodBoolean>;
+    cloudFront: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export declare const ParsedSubdomainDelegationSchema: z.ZodObject<{
     subdomain: z.ZodString;
@@ -130,6 +134,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
     }>;
     hostedZoneId: z.ZodOptional<z.ZodString>;
     delegatedSubdomain: z.ZodOptional<z.ZodString>;
+    adoptedNameServers: z.ZodOptional<z.ZodArray<z.ZodString>>;
     records: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"standard">;
         type: z.ZodEnum<{
@@ -171,6 +176,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
         domainName: z.ZodString;
         subjectAlternativeNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
         transparencyLogging: z.ZodOptional<z.ZodBoolean>;
+        cloudFront: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     delegations: z.ZodArray<z.ZodObject<{
         subdomain: z.ZodString;

package/dist/src/dns/domainRecords.js

@@ -1 +1 @@
-import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),i=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),o=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[i,o]),c=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional()}).strict(),d=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),records:e.array(s),certificates:e.array(c),delegations:e.array(d)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,o as ParsedAliasRecordSchema,c as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,i as ParsedStandardRecordSchema,d as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};
+import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),o=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),i=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[o,i]),d=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),c=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(s),certificates:e.array(d),delegations:e.array(c)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,i as ParsedAliasRecordSchema,d as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,o as ParsedStandardRecordSchema,c as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};

package/dist/src/schemas/buildkiteSchemas.d.ts

@@ -8,7 +8,7 @@ import { z } from "zod";
 export declare const BuildkitePropsObjectSchema: z.ZodObject<{
     buildkiteQueue: z.ZodString;
     buildkiteOrgSlug: z.ZodString;
-    agentTokenSsmParameterName: z.ZodString;
+    agentTokenSsmParameterName: z.ZodOptional<z.ZodString>;
     agentTokenKmsKeyArn: z.ZodOptional<z.ZodString>;
     fjallApiKeySsmParameterName: z.ZodOptional<z.ZodString>;
     instanceType: z.ZodDefault<z.ZodString>;
@@ -68,7 +68,7 @@ export type BuildkitePropsObject = z.infer<typeof BuildkitePropsObjectSchema>;
 export declare const BuildkitePropsSchema: z.ZodObject<{
     buildkiteQueue: z.ZodString;
     buildkiteOrgSlug: z.ZodString;
-    agentTokenSsmParameterName: z.ZodString;
+    agentTokenSsmParameterName: z.ZodOptional<z.ZodString>;
     agentTokenKmsKeyArn: z.ZodOptional<z.ZodString>;
     fjallApiKeySsmParameterName: z.ZodOptional<z.ZodString>;
     instanceType: z.ZodDefault<z.ZodString>;

package/dist/src/schemas/buildkiteSchemas.js

@@ -1,3 +1,3 @@
-var r=Object.defineProperty;var i=(n,t)=>r(n,"name",{value:t,configurable:!0});import{z as e}from"zod";const s=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],o=e.object({buildkiteQueue:e.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:e.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:e.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)"),agentTokenKmsKeyArn:e.string().min(1).optional(),fjallApiKeySsmParameterName:e.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:e.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:e.number().int().min(20).max(1e3).default(250),agentMinInstances:e.number().int().min(0).default(0),agentMaxInstances:e.number().int().min(1).default(2),agentsPerInstance:e.number().int().min(1).default(1),spotCapacityPercentage:e.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:e.number().int().min(60).default(600),disconnectAfterUptimeSeconds:e.number().int().min(3600).default(86400),maxInstanceLifetimeDays:e.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:e.boolean().default(!1),purgeBuildsOnDiskFull:e.boolean().default(!0),terminateInstanceOnDiskFull:e.boolean().default(!1),logRetentionDays:e.number().int().min(1).default(30),agentLogRetentionDays:e.literal(s).default(7),buildkiteAgentRelease:e.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:e.string().default(""),buildkiteAgentTimestampLines:e.boolean().default(!1),buildkiteAgentExperiments:e.string().default(""),buildkiteAgentTracingBackend:e.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:e.number().int().min(10).default(60),enableSecretsPlugin:e.boolean().default(!0),enableEcrPlugin:e.boolean().default(!1),enableDockerLoginPlugin:e.boolean().default(!1),enableDockerUserNamespaceRemap:e.boolean().default(!0),enableDockerExperimental:e.boolean().default(!1),dockerNetworkingProtocol:e.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:e.boolean().default(!1),mountTmpfsAtTmp:e.boolean().default(!0),buildkiteAgentEnableGitMirrors:e.boolean().default(!1),bootstrapScriptUrl:e.string().default(""),agentEnvFileUrl:e.string().default(""),scalerEventSchedulePeriod:e.string().min(1).default("1 minute"),scalerMinPollInterval:e.string().min(1).default("10s"),scaleOutFactor:e.string().min(1).default("1.0"),scaleOutWaitingForJobs:e.boolean().default(!1),rolePermissionsBoundaryArn:e.string().min(1).optional(),alarmSnsTopicArn:e.string().min(1).optional(),applicationId:e.string().min(1).optional(),costAllocationEnvironment:e.string().min(1).optional(),costAllocationOwner:e.string().min(1).optional()}).strict(),u=o.refine(n=>n.agentMinInstances<=n.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function g(n){const t=u.safeParse(n);if(!t.success){const l=t.error.issues.map(a=>`  - ${a.path.join(".")||"(root)"}: ${a.message}`).join(`
+var r=Object.defineProperty;var i=(n,t)=>r(n,"name",{value:t,configurable:!0});import{z as e}from"zod";const s=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],o=e.object({buildkiteQueue:e.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:e.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:e.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:e.string().min(1).optional(),fjallApiKeySsmParameterName:e.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:e.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:e.number().int().min(20).max(1e3).default(250),agentMinInstances:e.number().int().min(0).default(0),agentMaxInstances:e.number().int().min(1).default(2),agentsPerInstance:e.number().int().min(1).default(1),spotCapacityPercentage:e.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:e.number().int().min(60).default(600),disconnectAfterUptimeSeconds:e.number().int().min(3600).default(86400),maxInstanceLifetimeDays:e.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:e.boolean().default(!1),purgeBuildsOnDiskFull:e.boolean().default(!0),terminateInstanceOnDiskFull:e.boolean().default(!1),logRetentionDays:e.number().int().min(1).default(30),agentLogRetentionDays:e.literal(s).default(7),buildkiteAgentRelease:e.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:e.string().default(""),buildkiteAgentTimestampLines:e.boolean().default(!1),buildkiteAgentExperiments:e.string().default(""),buildkiteAgentTracingBackend:e.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:e.number().int().min(10).default(60),enableSecretsPlugin:e.boolean().default(!0),enableEcrPlugin:e.boolean().default(!1),enableDockerLoginPlugin:e.boolean().default(!1),enableDockerUserNamespaceRemap:e.boolean().default(!0),enableDockerExperimental:e.boolean().default(!1),dockerNetworkingProtocol:e.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:e.boolean().default(!1),mountTmpfsAtTmp:e.boolean().default(!0),buildkiteAgentEnableGitMirrors:e.boolean().default(!1),bootstrapScriptUrl:e.string().default(""),agentEnvFileUrl:e.string().default(""),scalerEventSchedulePeriod:e.string().min(1).default("1 minute"),scalerMinPollInterval:e.string().min(1).default("10s"),scaleOutFactor:e.string().min(1).default("1.0"),scaleOutWaitingForJobs:e.boolean().default(!1),rolePermissionsBoundaryArn:e.string().min(1).optional(),alarmSnsTopicArn:e.string().min(1).optional(),applicationId:e.string().min(1).optional(),costAllocationEnvironment:e.string().min(1).optional(),costAllocationOwner:e.string().min(1).optional()}).strict(),u=o.refine(n=>n.agentMinInstances<=n.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function g(n){const t=u.safeParse(n);if(!t.success){const l=t.error.issues.map(a=>`  - ${a.path.join(".")||"(root)"}: ${a.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${l}`)}return t.data}i(g,"validateBuildkiteProps");export{o as BuildkitePropsObjectSchema,u as BuildkitePropsSchema,g as validateBuildkiteProps};

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",s="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function S(e){return`FjallDevDeploy${e}`}a(S,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",E="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function w(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t}=e,o={[`${t}:aud`]:s};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`,`org:${l}:dev-substrate-setup`]}}}]}a(w,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:s},StringLike:{[`${t}:sub`]:`org:${l}:dev:${o}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:r,sid:t,subject:o}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:s,[`${r}:sub`]:o}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,E as DEV_SYNC_WRITER_POLICY_NAME,s as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,w as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,S as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};
+var n=Object.defineProperty;var a=(e,t)=>n(e,"name",{value:t,configurable:!0});const v="fjall.io",r="sts.amazonaws.com",S="0000000000000000000000000000000000000000";function A(e){return`FjallDevDeploy${e}`}a(A,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",w="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function E(e){const{fjallOrgId:t,providerArn:s,issuerDomain:l}=e,o={[`${l}:aud`]:r};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:`org:${t}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${l}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}a(E,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:t,providerArn:s,issuerDomain:l,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${l}:aud`]:r},StringLike:{[`${l}:sub`]:`org:${t}:dev:${o}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:t,issuerDomain:s,sid:l,subject:o}=e;return[{Sid:l,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${s}:aud`]:r,[`${s}:sub`]:o}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function P(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(P,"buildDevSyncWriterTrustStatements");function b({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevPassSubstrateExecutionRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/FjallDev*Compute-DevSubstrate*`,Condition:{StringEquals:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}]}a(b,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a($,"buildDevSyncWriterPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a(T,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,w as DEV_SYNC_WRITER_POLICY_NAME,r as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,S as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,T as buildDevBoundaryStatements,b as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,$ as buildDevSyncWriterPolicyStatements,P as buildDevSyncWriterTrustStatements,E as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,A as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "3.4.1";
+export declare const GENERATOR_VERSION = "3.6.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="3.4.1";export{E as GENERATOR_VERSION};
+const E="3.6.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "3.4.1",
+  "version": "3.6.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^3.4.1",
+    "@fjall/util": "^3.6.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "6d8ef9582d5abe6a8199431815dae761887c18d4"
+  "gitHead": "10366db602d7e80669e22825a52071a47e05c3b7"
 }