@fjall/generator 3.5.2 → 3.6.0

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-19T20:59:24.927Z
+146 files minified at 2026-07-19T21:13:14.544Z

package/dist/src/ast/domain/astDomainParser.d.ts

@@ -62,6 +62,13 @@ export interface ParsedCertificateFromAst {
     readonly domainName: string;
     readonly subjectAlternativeNames?: string[];
     readonly transparencyLogging?: boolean;
+    /**
+     * D3 CloudFront viewer-certificate designation. Parsed fail-closed: a
+     * present-but-dynamic value is refused rather than dropped — silently
+     * losing it would strip the zone-level us-east-1 export contract on an
+     * import/eject round trip.
+     */
+    readonly cloudFront?: boolean;
 }
 interface ParsedDomainCommon {
     readonly zoneName: string;
@@ -78,6 +85,17 @@ export interface ParsedRoute53ApexDomainProps extends ParsedDomainCommon {
 export interface ParsedExternalDelegatedDomainProps extends ParsedDomainCommon {
     readonly registrar: "external-delegated";
     readonly delegatedSubdomain: string;
+    /**
+     * Child-zone ADOPTION: hosted zone id of an EXISTING delegated zone.
+     * Both-or-neither with `adoptedNameServers` (validated here fail-closed —
+     * a one-sided declaration must never survive an import/eject round trip).
+     */
+    readonly hostedZoneId: string | undefined;
+    /**
+     * Literal NS hostnames of the adopted zone — the parent NS UPSERT carries
+     * them verbatim because an imported zone exposes no NS attribute at synth.
+     */
+    readonly adoptedNameServers: string[] | undefined;
     /**
      * D8 child-writes delegation: LITERAL parent DelegationRole ARN, when the
      * source declares one. `undefined` when absent (the CLI injects it at

package/dist/src/ast/domain/astDomainParser.js

@@ -1 +1 @@
-var D=Object.defineProperty;var a=(e,n)=>D(e,"name",{value:n,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as R,asString as c,asStringUnion as h,asStringArray as k,asBoolean as T,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as u}from"../../types/Result.js";import{DnsRecordTypeSchema as I}from"../../dns/types.js";import{DomainRegistrarSchema as v,DomainDeployPhaseSchema as L,AliasRecordTypeSchema as j,TYPED_FJALL_TARGET_KINDS as O}from"../../dns/domainRecords.js";const A=v.options,S=L.options,C=I.options,V=j.options;function ne(e){const n=[],t=a(i=>{if(m.isNewExpression(i)&&P(i.expression)){const o=Z(i);o!==void 0&&n.push(o)}m.forEachChild(i,t)},"visit");if(t(e),n.length===0)return l(void 0);if(n.length>1)return u(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${n.length}`));const r=n[0];return r?l(r):l(void 0)}a(ne,"findDomainConstructCall");function P(e){return m.isIdentifier(e)&&e.text==="Domain"}a(P,"isDomainIdentifier");function Z(e){const n=e.arguments;if(!n||n.length<3)return;const t=n[0],r=n[1],i=n[2];if(!t||!r||!i||!m.isObjectLiteralExpression(i))return;const o=z(e);if(o===void 0)return;const d=M(e),s=m.isStringLiteral(r)?r.text:void 0;return{callExpression:e,containingStatement:o,propsObjectLiteral:i,domainVarId:d,scopeArgumentText:t.getText(),constructIdLiteral:s}}a(Z,"buildMatch");function z(e){let n=e;for(;n!==void 0;){if(m.isExpressionStatement(n)||m.isVariableStatement(n))return n;n=n.parent}}a(z,"findContainingTopLevelStatement");function M(e){let n=e.parent;for(;n!==void 0;){if(m.isVariableDeclaration(n)&&m.isIdentifier(n.name)&&n.initializer===e)return n.name.text;n=n.parent}}a(M,"extractDomainVarId");function q(e){switch(e.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${A.join(", ")}, got ${JSON.stringify(e.value)}`;case"missing_field":return`'${e.field}' property is required`;case"invalid_literal":return`'${e.field}' ${e.reason}`;case"removed_field":return`'${e.field}' was removed from the Domain API \u2014 ${e.cure}`}}a(q,"errorMessage");const B="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function te(e){const n=R(e),t=h(n.registrar,A);if(t===void 0){const s=n.registrar;if(s===void 0)return u({kind:"registrar_required"});const f=typeof s=="string"?s:_(s);return u({kind:"registrar_unsupported",value:f})}const r=c(n.zoneName);if(r===void 0)return u({kind:"missing_field",field:"zoneName"});const i=J(n.records);if(!i.success)return i;const o=H(n.certificates);if(!o.success)return o;if(n.delegations!==void 0)return u({kind:"removed_field",field:"delegations",cure:B});const d={zoneName:r,description:c(n.description),costAllocationEnvironment:c(n.costAllocationEnvironment),tags:K(n.tags),records:i.data,certificates:o.data};switch(t){case"route53":return l({...d,registrar:t,hostedZoneId:c(n.hostedZoneId)});case"external-delegated":{const s=c(n.delegatedSubdomain);if(s===void 0)return u({kind:"missing_field",field:"delegatedSubdomain"});const f=c(n.parentDelegationRoleArn);if(n.parentDelegationRoleArn!==void 0&&f===void 0)return u({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const y=h(n.phase,S);return n.phase!==void 0&&y===void 0?u({kind:"invalid_literal",field:"phase",reason:`must be one of ${S.map(N=>`'${N}'`).join(", ")}`}):l({...d,registrar:t,delegatedSubdomain:s,parentDelegationRoleArn:f,phase:y})}case"external-records":return l({...d,registrar:t})}}a(te,"parseDomainProps");function ie(e){return q(e)}a(ie,"parseDomainErrorMessage");function J(e){if(e===void 0)return l([]);if(!Array.isArray(e))return u({kind:"invalid_literal",field:"records",reason:"must be an array"});const n=[];for(let t=0;t<e.length;t++){const r=e[t];if(!g(r))return u({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const i=F(r,t);if(!i.success)return i;n.push(i.data)}return l(n)}a(J,"parseRecordsArray");function F(e,n){const t=c(e.type),r=c(e.name);if(t===void 0)return u({kind:"missing_field",field:`records[${n}].type`});if(r===void 0)return u({kind:"missing_field",field:`records[${n}].name`});if(e.target!==void 0){if(!V.some(f=>f===t))return u({kind:"invalid_literal",field:`records[${n}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=U(e.target);return l({kind:"alias",type:t,name:r,target:s})}if(!C.some(s=>s===t))return u({kind:"invalid_literal",field:`records[${n}]`,reason:`unsupported record type '${t}'`});const i=G(e.value);if(i===void 0)return u({kind:"invalid_literal",field:`records[${n}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(e.value)})`});const o=$(e.ttl),d={kind:"standard",type:t,name:r,value:i,...o!==void 0?{ttl:o}:{}};return l(d)}a(F,"parseRecord");function G(e){if(e===void 0)return;if(typeof e=="string")return e;const n=k(e);if(n!==void 0)return n}a(G,"parseRecordValue");function U(e){if(E(e))return Y(e);if(g(e)){const n=h(e.kind,O);if(n==="ecs"||n==="cdn"){const t=c(e.appName);if(t!==void 0)return{kind:n,appName:t}}if(n==="bucket"){const t=c(e.bucketName);if(t!==void 0)return{kind:n,bucketName:t}}if(n==="custom"){const t=c(e.dnsName),r=c(e.hostedZoneId);if(t!==void 0&&r!==void 0)return{kind:n,dnsName:t,hostedZoneId:r}}}return{kind:"unresolved",sourceText:_(e)}}a(U,"parseTarget");function Y(e){const n=e.__call.trim(),t=n.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:n};const r=t[1],i=t[2]??"",o=b(i);switch(r){case"fjallApp":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"ecs",appName:d}}case"fjallCdn":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"cdn",appName:d}}case"fjallBucket":{const d=p(o,0);return d===void 0?{kind:"dynamic",sourceText:n}:{kind:"bucket",bucketName:d}}case"aliasTo":{if(o.length>=2){const d=p(o,0),s=p(o,1);return d!==void 0&&s!==void 0?{kind:"custom",dnsName:d,hostedZoneId:s}:{kind:"dynamic",sourceText:n}}if(o.length===1){const d=o[0]?.trim()??"",s=x(d,"dnsName"),f=x(d,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:n}}return{kind:"unresolved",sourceText:n}}default:return{kind:"unresolved",sourceText:n}}}a(Y,"resolveCallRefTarget");function b(e){const n=[];let t=0,r=null,i="";for(let d=0;d<e.length;d++){const s=e[d];if(r!==null){if(i+=s,s==="\\"&&d+1<e.length){const f=e[d+1];f!==void 0&&(i+=f,d+=1);continue}s===r&&(r=null);continue}if(s==='"'||s==="'"||s==="`"){r=s,i+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,i+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,i+=s;continue}if(s===","&&t===0){n.push(i.trim()),i="";continue}i+=s}const o=i.trim();return o.length>0&&n.push(o),n}a(b,"splitTopLevelArgs");function p(e,n){const t=e[n];if(t===void 0)return;const r=t.trim();if(r.length<2)return;const i=r[0],o=r[r.length-1];if(i===o&&!(i!=='"'&&i!=="'"&&i!=="`"))return r.slice(1,-1)}a(p,"extractStringLiteralArg");function x(e,n){const t=e.trim().replace(/^\{|\}$/g,""),r=b(t);for(const i of r){const o=i.indexOf(":");if(o<0||i.slice(0,o).trim().replace(/["'`]/g,"")!==n)continue;const s=i.slice(o+1).trim();return p([s],0)}}a(x,"extractObjectFieldString");function H(e){if(e===void 0)return l([]);if(!Array.isArray(e))return u({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const n=[];for(let t=0;t<e.length;t++){const r=e[t];if(typeof r=="string"){n.push({domainName:r});continue}if(!g(r))return u({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const i=c(r.domainName);if(i===void 0)return u({kind:"missing_field",field:`certificates[${t}].domainName`});const o=k(r.subjectAlternativeNames),d=T(r.transparencyLogging);n.push({domainName:i,...o!==void 0?{subjectAlternativeNames:o}:{},...d!==void 0?{transparencyLogging:d}:{}})}return l(n)}a(H,"parseCertificatesArray");function K(e){if(e===void 0||!g(e))return;const n={};for(const[t,r]of Object.entries(e)){const i=c(r);i!==void 0&&(n[t]=i)}return Object.keys(n).length===0?void 0:n}a(K,"parseStringRecord");function _(e){if(e===void 0)return"undefined";if(e===null)return"null";if(typeof e=="string")return JSON.stringify(e);if(typeof e=="number"||typeof e=="boolean")return String(e);if(Array.isArray(e))return`[${e.map(n=>_(n)).join(", ")}]`;if(typeof e=="object"){if("__call"in e)return String(e.__call);if("__identifier"in e)return String(e.__identifier);if("__expression"in e)return String(e.__expression);if("__unknown"in e)return String(e.__unknown)}return String(e)}a(_,"stringifyParsedValue");export{ne as findDomainConstructCall,ie as parseDomainErrorMessage,te as parseDomainProps,b as splitTopLevelArgs};
+var R=Object.defineProperty;var u=(n,e)=>R(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as T,asString as c,asStringUnion as _,asStringArray as y,asBoolean as b,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as L}from"../../dns/types.js";import{DomainRegistrarSchema as j,DomainDeployPhaseSchema as Z,AliasRecordTypeSchema as O,TYPED_FJALL_TARGET_KINDS as C}from"../../dns/domainRecords.js";const N=j.options,x=Z.options,P=L.options,V=O.options;function ie(n){const e=[],t=u(i=>{if(m.isNewExpression(i)&&z(i.expression)){const d=F(i);d!==void 0&&e.push(d)}m.forEachChild(i,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const r=e[0];return r?l(r):l(void 0)}u(ie,"findDomainConstructCall");function z(n){return m.isIdentifier(n)&&n.text==="Domain"}u(z,"isDomainIdentifier");function F(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],r=e[1],i=e[2];if(!t||!r||!i||!m.isObjectLiteralExpression(i))return;const d=M(n);if(d===void 0)return;const o=q(n),s=m.isStringLiteral(r)?r.text:void 0;return{callExpression:n,containingStatement:d,propsObjectLiteral:i,domainVarId:o,scopeArgumentText:t.getText(),constructIdLiteral:s}}u(F,"buildMatch");function M(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(M,"findContainingTopLevelStatement");function q(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(q,"extractDomainVarId");function B(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${N.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(B,"errorMessage");const J="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function re(n){const e=T(n),t=_(e.registrar,N);if(t===void 0){const s=e.registrar;if(s===void 0)return a({kind:"registrar_required"});const f=typeof s=="string"?s:k(s);return a({kind:"registrar_unsupported",value:f})}const r=c(e.zoneName);if(r===void 0)return a({kind:"missing_field",field:"zoneName"});const i=U(e.records);if(!i.success)return i;const d=Q(e.certificates);if(!d.success)return d;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:J});const o={zoneName:r,description:c(e.description),costAllocationEnvironment:c(e.costAllocationEnvironment),tags:W(e.tags),records:i.data,certificates:d.data};switch(t){case"route53":return l({...o,registrar:t,hostedZoneId:c(e.hostedZoneId)});case"external-delegated":{const s=c(e.delegatedSubdomain);if(s===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const f=c(e.hostedZoneId);if(e.hostedZoneId!==void 0&&f===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const h=y(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&h===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(f===void 0!=(h===void 0))return a({kind:"invalid_literal",field:f===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const S=c(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&S===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const A=_(e.phase,x);return e.phase!==void 0&&A===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${x.map(I=>`'${I}'`).join(", ")}`}):l({...o,registrar:t,delegatedSubdomain:s,hostedZoneId:f,adoptedNameServers:h,parentDelegationRoleArn:S,phase:A})}case"external-records":return l({...o,registrar:t})}}u(re,"parseDomainProps");function se(n){return B(n)}u(se,"parseDomainErrorMessage");function U(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(!g(r))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const i=G(r,t);if(!i.success)return i;e.push(i.data)}return l(e)}u(U,"parseRecordsArray");function G(n,e){const t=c(n.type),r=c(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(r===void 0)return a({kind:"missing_field",field:`records[${e}].name`});if(n.target!==void 0){if(!V.some(f=>f===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=H(n.target);return l({kind:"alias",type:t,name:r,target:s})}if(!P.some(s=>s===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const i=Y(n.value);if(i===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const d=$(n.ttl),o={kind:"standard",type:t,name:r,value:i,...d!==void 0?{ttl:d}:{}};return l(o)}u(G,"parseRecord");function Y(n){if(n===void 0)return;if(typeof n=="string")return n;const e=y(n);if(e!==void 0)return e}u(Y,"parseRecordValue");function H(n){if(E(n))return K(n);if(g(n)){const e=_(n.kind,C);if(e==="ecs"||e==="cdn"){const t=c(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=c(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=c(n.dnsName),r=c(n.hostedZoneId);if(t!==void 0&&r!==void 0)return{kind:e,dnsName:t,hostedZoneId:r}}}return{kind:"unresolved",sourceText:k(n)}}u(H,"parseTarget");function K(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const r=t[1],i=t[2]??"",d=v(i);switch(r){case"fjallApp":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:o}}case"fjallCdn":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:o}}case"fjallBucket":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:o}}case"aliasTo":{if(d.length>=2){const o=p(d,0),s=p(d,1);return o!==void 0&&s!==void 0?{kind:"custom",dnsName:o,hostedZoneId:s}:{kind:"dynamic",sourceText:e}}if(d.length===1){const o=d[0]?.trim()??"",s=D(o,"dnsName"),f=D(o,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(K,"resolveCallRefTarget");function v(n){const e=[];let t=0,r=null,i="";for(let o=0;o<n.length;o++){const s=n[o];if(r!==null){if(i+=s,s==="\\"&&o+1<n.length){const f=n[o+1];f!==void 0&&(i+=f,o+=1);continue}s===r&&(r=null);continue}if(s==='"'||s==="'"||s==="`"){r=s,i+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,i+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,i+=s;continue}if(s===","&&t===0){e.push(i.trim()),i="";continue}i+=s}const d=i.trim();return d.length>0&&e.push(d),e}u(v,"splitTopLevelArgs");function p(n,e){const t=n[e];if(t===void 0)return;const r=t.trim();if(r.length<2)return;const i=r[0],d=r[r.length-1];if(i===d&&!(i!=='"'&&i!=="'"&&i!=="`"))return r.slice(1,-1)}u(p,"extractStringLiteralArg");function D(n,e){const t=n.trim().replace(/^\{|\}$/g,""),r=v(t);for(const i of r){const d=i.indexOf(":");if(d<0||i.slice(0,d).trim().replace(/["'`]/g,"")!==e)continue;const s=i.slice(d+1).trim();return p([s],0)}}u(D,"extractObjectFieldString");function Q(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(typeof r=="string"){e.push({domainName:r});continue}if(!g(r))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const i=c(r.domainName);if(i===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const d=y(r.subjectAlternativeNames),o=b(r.transparencyLogging),s=b(r.cloudFront);if(r.cloudFront!==void 0&&s===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:i,...d!==void 0?{subjectAlternativeNames:d}:{},...o!==void 0?{transparencyLogging:o}:{},...s!==void 0?{cloudFront:s}:{}})}return l(e)}u(Q,"parseCertificatesArray");function W(n){if(n===void 0||!g(n))return;const e={};for(const[t,r]of Object.entries(n)){const i=c(r);i!==void 0&&(e[t]=i)}return Object.keys(e).length===0?void 0:e}u(W,"parseStringRecord");function k(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>k(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(k,"stringifyParsedValue");export{ie as findDomainConstructCall,se as parseDomainErrorMessage,re as parseDomainProps,v as splitTopLevelArgs};

package/dist/src/dns/domainFileGenerator.js

@@ -1,7 +1,7 @@
-var m=Object.defineProperty;var r=(a,e)=>m(a,"name",{value:e,configurable:!0});import{toPascalCase as p}from"../generation/common.js";import{GENERATOR_VERSION as i}from"../version.js";function D(a){const{domainName:e,hostedZoneId:o,records:n=[]}=a,t=`fjall/domains/${e}`;return[{path:`${t}/infrastructure.ts`,content:w({domainName:e,records:n,hostedZoneId:o})},{path:`${t}/package.json`,content:f(e)},{path:`${t}/tsconfig.json`,content:g},{path:`${t}/cdk.json`,content:y},{path:`${t}/.gitignore`,content:k}]}r(D,"generateDomainFiles");function w(a){const{domainName:e,records:o,hostedZoneId:n}=a,t=p(e.split(".").join("")),c=o.map(s=>{const l=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${l} },`}),u=c.length>0?`[
-${c.join(`
+var p=Object.defineProperty;var r=(t,e)=>p(t,"name",{value:e,configurable:!0});import{getDomainStackName as w}from"@fjall/util";import{toPascalCase as f}from"../generation/common.js";import{GENERATOR_VERSION as u}from"../version.js";function j(t){const{domainName:e,hostedZoneId:o,records:n=[]}=t,a=`fjall/domains/${e}`;return[{path:`${a}/infrastructure.ts`,content:k({domainName:e,records:n,hostedZoneId:o})},{path:`${a}/package.json`,content:g(e)},{path:`${a}/tsconfig.json`,content:S},{path:`${a}/cdk.json`,content:N},{path:`${a}/.gitignore`,content:y}]}r(j,"generateDomainFiles");function k(t){const{domainName:e,records:o,hostedZoneId:n}=t,a=f(e.split(".").join("")),c=w(e),i=o.map(s=>{const m=s.ttl!==void 0?`, ttl: ${s.ttl}`:"";return`    { type: ${JSON.stringify(s.type)}, name: ${JSON.stringify(s.name)}, value: ${JSON.stringify(s.value)}${m} },`}),d=i.length>0?`[
+${i.join(`
 `)}
-  ]`:"[]",d=n?`  hostedZoneId: ${JSON.stringify(n)},
+  ]`:"[]",l=n?`  hostedZoneId: ${JSON.stringify(n)},
 `:"";return`import {
   App,
   Domain,
@@ -10,27 +10,29 @@ ${c.join(`
 // Fjall-managed domain \u2014 edit this file to add or change records.
 // See https://docs.fjall.io/resources/networking/domain for the Domain construct API.
 
-const app = App.getApp(${JSON.stringify(`${t}Domain`)});
+const app = App.getApp(${JSON.stringify(c)});
 
 // Stack name must equal getDomainStackName(${JSON.stringify(e)}) \u2014 the CLI's
 // deploy record and ManagedDomainBinding resolution both DescribeStacks by it.
-const stack = app.getStack(${JSON.stringify(`${t}Domain`)}).getStack();
+const stack = app.getStack(${JSON.stringify(c)}).getStack();
 
-new Domain(stack, ${JSON.stringify(t)}, {
+new Domain(stack, ${JSON.stringify(a)}, {
   registrar: "route53",
   zoneName: ${JSON.stringify(e)},
-${d}  certificates: [
+${l}  certificates: [
     { domainName: ${JSON.stringify(e)} },
   ],
-  records: ${u},
+  records: ${d},
 });
-`}r(w,"generateDefaultInfrastructureTs");function f(a){return JSON.stringify({name:`domain-${a}`,version:i,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${i}`,"aws-cdk-lib":"^2.260.0",constructs:"^10.6.0"}},null,2)+`
-`}r(f,"generateDomainPackageJson");const k=`node_modules/
+`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.260.0",constructs:"^10.6.0"}},null,2)+`
+`}r(g,"generateDomainPackageJson");const y=`node_modules/
 cdk.out/
 *.d.ts
 *.js
+.fjall-state*.json
+.fjall-state*.json.tmp
 .deploy-state.json
 .deploy-state.json.tmp
-`,g=JSON.stringify({compilerOptions:{target:"ES2020",module:"commonjs",lib:["es2020","dom"],declaration:!0,strict:!0,noImplicitAny:!0,strictNullChecks:!0,noImplicitThis:!0,alwaysStrict:!0,noUnusedLocals:!1,noUnusedParameters:!1,noImplicitReturns:!0,noFallthroughCasesInSwitch:!1,inlineSourceMap:!0,inlineSources:!0,experimentalDecorators:!0,strictPropertyInitialization:!1,typeRoots:["./node_modules/@types"]},exclude:["node_modules","cdk.out"]},null,2)+`
-`,y=JSON.stringify({app:"npx ts-node --prefer-ts-exts --transpile-only infrastructure.ts",assetMetadata:!1,pathMetadata:!1,versionReporting:!1,watch:{include:["**"],exclude:["README.md","cdk*.json","**/*.d.ts","**/*.js","tsconfig.json","package*.json","yarn.lock","node_modules","test"]},context:{"@aws-cdk/aws-lambda:recognizeLayerVersion":!0,"@aws-cdk/core:checkSecretUsage":!0,"@aws-cdk/core:target-partitions":["aws","aws-cn"],"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver":!0,"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName":!0,"@aws-cdk/aws-ecs:arnFormatIncludesClusterName":!0,"@aws-cdk/aws-iam:minimizePolicies":!0,"@aws-cdk/core:validateSnapshotRemovalPolicy":!0,"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName":!0,"@aws-cdk/aws-s3:createDefaultLoggingPolicy":!0,"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":!0,"@aws-cdk/aws-apigateway:disableCloudWatchRole":!0,"@aws-cdk/core:enablePartitionLiterals":!0,"@aws-cdk/aws-events:eventsTargetQueueSameAccount":!0,"@aws-cdk/aws-iam:standardizedServicePrincipals":!0,"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":!0,"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName":!0,"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":!0,"@aws-cdk/aws-route53-patters:useCertificate":!0,"@aws-cdk/customresources:installLatestAwsSdkDefault":!1,"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":!0,"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup":!0,"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId":!0,"@aws-cdk/aws-ec2:launchTemplateDefaultUserData":!0,"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments":!0,"@aws-cdk/aws-redshift:columnId":!0,"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":!0,"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup":!0,"@aws-cdk/aws-apigateway:requestValidatorUniqueId":!0,"@aws-cdk/aws-kms:aliasNameRef":!0,"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig":!0,"@aws-cdk/core:includePrefixInUniqueNameGeneration":!0,"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby":!0}},null,2)+`
-`;export{D as generateDomainFiles};
+`,S=JSON.stringify({compilerOptions:{target:"ES2020",module:"commonjs",lib:["es2020","dom"],declaration:!0,strict:!0,noImplicitAny:!0,strictNullChecks:!0,noImplicitThis:!0,alwaysStrict:!0,noUnusedLocals:!1,noUnusedParameters:!1,noImplicitReturns:!0,noFallthroughCasesInSwitch:!1,inlineSourceMap:!0,inlineSources:!0,experimentalDecorators:!0,strictPropertyInitialization:!1,typeRoots:["./node_modules/@types"]},exclude:["node_modules","cdk.out"]},null,2)+`
+`,N=JSON.stringify({app:"npx ts-node --prefer-ts-exts --transpile-only infrastructure.ts",assetMetadata:!1,pathMetadata:!1,versionReporting:!1,watch:{include:["**"],exclude:["README.md","cdk*.json","**/*.d.ts","**/*.js","tsconfig.json","package*.json","yarn.lock","node_modules","test"]},context:{"@aws-cdk/aws-lambda:recognizeLayerVersion":!0,"@aws-cdk/core:checkSecretUsage":!0,"@aws-cdk/core:target-partitions":["aws","aws-cn"],"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver":!0,"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName":!0,"@aws-cdk/aws-ecs:arnFormatIncludesClusterName":!0,"@aws-cdk/aws-iam:minimizePolicies":!0,"@aws-cdk/core:validateSnapshotRemovalPolicy":!0,"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName":!0,"@aws-cdk/aws-s3:createDefaultLoggingPolicy":!0,"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption":!0,"@aws-cdk/aws-apigateway:disableCloudWatchRole":!0,"@aws-cdk/core:enablePartitionLiterals":!0,"@aws-cdk/aws-events:eventsTargetQueueSameAccount":!0,"@aws-cdk/aws-iam:standardizedServicePrincipals":!0,"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker":!0,"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName":!0,"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy":!0,"@aws-cdk/aws-route53-patters:useCertificate":!0,"@aws-cdk/customresources:installLatestAwsSdkDefault":!1,"@aws-cdk/aws-rds:databaseProxyUniqueResourceName":!0,"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup":!0,"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId":!0,"@aws-cdk/aws-ec2:launchTemplateDefaultUserData":!0,"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments":!0,"@aws-cdk/aws-redshift:columnId":!0,"@aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2":!0,"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup":!0,"@aws-cdk/aws-apigateway:requestValidatorUniqueId":!0,"@aws-cdk/aws-kms:aliasNameRef":!0,"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig":!0,"@aws-cdk/core:includePrefixInUniqueNameGeneration":!0,"@aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby":!0}},null,2)+`
+`;export{j as generateDomainFiles};

package/dist/src/dns/domainRecords.d.ts

@@ -29,7 +29,10 @@ export type DomainRegistrar = z.infer<typeof DomainRegistrarSchema>;
  * R2 two-step deploy gate on the delegated-child Domain topology (D8):
  * `"zone"` synthesises the child zone + delegation record + records only;
  * `"full"` (the construct default) additionally issues certificates.
- * Mirrors `DomainDeployPhase` in @fjall/components-infrastructure.
+ * Mirrors `DomainDeployPhase`, homed in @fjall/util (re-exported by
+ * @fjall/components-infrastructure and @fjall/deploy-core). Kept as an
+ * independent zod enum: generator's parsers validate untrusted source text,
+ * so the schema is the contract here, not the type.
  */
 export declare const DomainDeployPhaseSchema: z.ZodEnum<{
     zone: "zone";
@@ -115,6 +118,7 @@ export declare const ParsedCertificateSchema: z.ZodObject<{
     domainName: z.ZodString;
     subjectAlternativeNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
     transparencyLogging: z.ZodOptional<z.ZodBoolean>;
+    cloudFront: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 export declare const ParsedSubdomainDelegationSchema: z.ZodObject<{
     subdomain: z.ZodString;
@@ -130,6 +134,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
     }>;
     hostedZoneId: z.ZodOptional<z.ZodString>;
     delegatedSubdomain: z.ZodOptional<z.ZodString>;
+    adoptedNameServers: z.ZodOptional<z.ZodArray<z.ZodString>>;
     records: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"standard">;
         type: z.ZodEnum<{
@@ -171,6 +176,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
         domainName: z.ZodString;
         subjectAlternativeNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
         transparencyLogging: z.ZodOptional<z.ZodBoolean>;
+        cloudFront: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     delegations: z.ZodArray<z.ZodObject<{
         subdomain: z.ZodString;

package/dist/src/dns/domainRecords.js

@@ -1 +1 @@
-import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),i=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),o=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[i,o]),c=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional()}).strict(),d=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),records:e.array(s),certificates:e.array(c),delegations:e.array(d)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,o as ParsedAliasRecordSchema,c as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,i as ParsedStandardRecordSchema,d as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};
+import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),o=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),i=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[o,i]),d=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),c=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(s),certificates:e.array(d),delegations:e.array(c)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,i as ParsedAliasRecordSchema,d as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,o as ParsedStandardRecordSchema,c as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "3.5.2";
+export declare const GENERATOR_VERSION = "3.6.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="3.5.2";export{E as GENERATOR_VERSION};
+const E="3.6.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "3.5.2",
+  "version": "3.6.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^3.5.2",
+    "@fjall/util": "^3.6.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "f59755647b2fd81ff692a3545e8e199d93c3bdf8"
+  "gitHead": "10366db602d7e80669e22825a52071a47e05c3b7"
 }