@fjall/generator 7.3.0 → 8.0.0

package/dist/.build-source-hash

@@ -9,10 +9,10 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "940dd689f74de4aba85a336a7c2c2f48358a0b9740fabec971c03be2294e0714",
+  "hash": "74a0bb134e5609fe93c1b79a77239f6b6d70c8db41fba13d0416c41d87bb28b0",
   "files": {
     "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
-    "src/ast/domain/astDomainParser.ts": "bac0b16eb2e62552",
+    "src/ast/domain/astDomainParser.ts": "940ce5742507477d",
     "src/ast/index.ts": "502a507c3764acbf",
     "src/ast/mutation/astCodeInjection.ts": "c1ebf483fb1e2332",
     "src/ast/mutation/astExpressionEvaluator.ts": "6082789268b91212",
@@ -39,24 +39,28 @@
     "src/codemod/drift/detect.ts": "af3fb518a9d7165d",
     "src/codemod/drift/index.ts": "e87e1ced35eefa44",
     "src/codemod/drift/merge.ts": "29093929befa9abd",
-    "src/codemod/drift/snapshot.ts": "f8ef6b4097aa3d10",
+    "src/codemod/drift/snapshot.ts": "d3c70df4f8537237",
     "src/codemod/drift/types.ts": "7f1d7899e420e4d7",
     "src/codemod/edits/addResource.ts": "c8fe476d5ef589fe",
     "src/codemod/edits/addResource/appBinding.ts": "3553fdb30fe06335",
     "src/codemod/edits/addResource/bodyIndex.ts": "3e179eac10d7bcf4",
     "src/codemod/edits/addResource/propertyBuilder.ts": "9102dff7e9fab376",
-    "src/codemod/edits/appendAccountToStage.ts": "2b92f93734497303",
+    "src/codemod/edits/appendAccountToStage.ts": "8c01227ad85021f2",
     "src/codemod/edits/controlFlowPolicy.ts": "e32bbe2894f76c65",
     "src/codemod/edits/crossPlanConnection.ts": "54a4ecb7b3368160",
     "src/codemod/edits/driftPolicy.ts": "5d9b7bb3505f987d",
     "src/codemod/edits/ensureImports.ts": "3ca0b6d446c4333c",
     "src/codemod/edits/findInsertionPosition.ts": "20cd34fdcf781017",
     "src/codemod/edits/index.ts": "bea5ed7c3983342b",
-    "src/codemod/edits/modifyResource.ts": "8f19d8c272c2613e",
+    "src/codemod/edits/modifyResource.ts": "c27380cf9dae5dfc",
     "src/codemod/edits/modifyResource/literalConversion.ts": "31295cccd59131b7",
+    "src/codemod/edits/moduleConstResolver.ts": "33f3e7ccac89b325",
+    "src/codemod/edits/objectGraph.ts": "beb4025daf6525d5",
     "src/codemod/edits/removeResource.ts": "2c7c8fe67bc3a866",
     "src/codemod/edits/removeResource/commentHeuristic.ts": "90b6ce7ba5aa2a48",
     "src/codemod/edits/removeResource/importPruning.ts": "f22783108b40f6cb",
+    "src/codemod/edits/secretsProvability.ts": "d723283918e31efd",
+    "src/codemod/edits/setContainerSecrets.ts": "07cbfac49b5329be",
     "src/codemod/edits/unmanagedShapeErrors.ts": "47a2644913c8e619",
     "src/codemod/edits/vpcPeer.ts": "0bcf90c2e6d16ca4",
     "src/codemod/edits/vpcPeerAccepter.ts": "c9eace933e9e2345",
@@ -68,7 +72,7 @@
     "src/codemod/fileRewriter/parse.ts": "b12026c31562a13c",
     "src/codemod/fileRewriter/print.ts": "f5ff7afb5b7786bf",
     "src/codemod/historyPaths.ts": "ef8084013146db57",
-    "src/codemod/index.ts": "6d786ef76a61fdc6",
+    "src/codemod/index.ts": "71ebede4ab133f9c",
     "src/codemod/listResources.ts": "97f206a50edbea20",
     "src/codemod/llmFallback/apply.ts": "2e656a6e55b3b4e3",
     "src/codemod/llmFallback/claudeTier.ts": "0a37fe782c85f75b",
@@ -101,10 +105,10 @@
     "src/codemod/validationGate/index.ts": "df5754bea9070410",
     "src/codemod/validationGate/types.ts": "af466ee5f3433042",
     "src/detection/index.ts": "b4ad9a935564cb3e",
-    "src/dns/bindParser.ts": "a5371cd1fa781ce6",
-    "src/dns/bindWriter.ts": "634b96dd15ee94b2",
+    "src/dns/bindParser.ts": "376d274bf9e4bf9f",
+    "src/dns/bindWriter.ts": "c296911ce5aef77c",
     "src/dns/domainFileGenerator.ts": "83451c031d3ed79c",
-    "src/dns/domainRecords.ts": "17f895ff9a7b719b",
+    "src/dns/domainRecords.ts": "ab917006b92ae916",
     "src/dns/index.ts": "b476ef3d7b381dc8",
     "src/dns/types.ts": "82d6db9d7d26dbc2",
     "src/generation/common.ts": "73fa0ad5ffeeeed4",
@@ -162,11 +166,11 @@
     "src/validation/patterns.ts": "f9629eafdad7ac3e",
     "src/validation/validationMessages.ts": "c727ade4690274f4",
     "src/validation/validationPatterns.ts": "865f3d688975b7c8",
-    "src/version.ts": "cb82d9efdb80e56a",
+    "src/version.ts": "d2ac361c506b072c",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "7b8ea09642d00081",
+    "package.json": "175b4806c4526e18",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "fbeb7c7236155acb29d05407d96d62c5e210f2478b90d1809a51fc9c2c96cd02",
-  "outputFileCount": 305
+  "outputHash": "328c5bda6ca2ae851022ef763790754a86c127a24c8de327ca3ed6ab00291f65",
+  "outputFileCount": 313
 }

package/dist/.minified

@@ -1 +1 @@
-152 files minified at 2026-08-06T23:10:36.463Z
+156 files minified at 2026-08-09T06:27:43.898Z

package/dist/src/ast/domain/astDomainParser.d.ts

@@ -27,6 +27,8 @@ export interface DomainCallMatch {
 export type ParsedFjallTarget = {
     readonly kind: "ecs";
     readonly appName: string;
+    /** Second `fjallApp` argument — present only for a multi-ALB app. */
+    readonly computeName?: string;
 } | {
     readonly kind: "cdn";
     readonly appName: string;

package/dist/src/ast/domain/astDomainParser.js

@@ -1 +1 @@
-var R=Object.defineProperty;var u=(n,e)=>R(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as T,asString as c,asStringUnion as _,asStringArray as y,asBoolean as b,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as L}from"../../dns/types.js";import{DomainRegistrarSchema as j,DomainDeployPhaseSchema as Z,AliasRecordTypeSchema as O,TYPED_FJALL_TARGET_KINDS as C}from"../../dns/domainRecords.js";const N=j.options,x=Z.options,P=L.options,V=O.options;function ie(n){const e=[],t=u(i=>{if(m.isNewExpression(i)&&z(i.expression)){const d=F(i);d!==void 0&&e.push(d)}m.forEachChild(i,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const r=e[0];return r?l(r):l(void 0)}u(ie,"findDomainConstructCall");function z(n){return m.isIdentifier(n)&&n.text==="Domain"}u(z,"isDomainIdentifier");function F(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],r=e[1],i=e[2];if(!t||!r||!i||!m.isObjectLiteralExpression(i))return;const d=M(n);if(d===void 0)return;const o=q(n),s=m.isStringLiteral(r)?r.text:void 0;return{callExpression:n,containingStatement:d,propsObjectLiteral:i,domainVarId:o,scopeArgumentText:t.getText(),constructIdLiteral:s}}u(F,"buildMatch");function M(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(M,"findContainingTopLevelStatement");function q(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(q,"extractDomainVarId");function B(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${N.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(B,"errorMessage");const J="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function re(n){const e=T(n),t=_(e.registrar,N);if(t===void 0){const s=e.registrar;if(s===void 0)return a({kind:"registrar_required"});const f=typeof s=="string"?s:k(s);return a({kind:"registrar_unsupported",value:f})}const r=c(e.zoneName);if(r===void 0)return a({kind:"missing_field",field:"zoneName"});const i=U(e.records);if(!i.success)return i;const d=Q(e.certificates);if(!d.success)return d;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:J});const o={zoneName:r,description:c(e.description),costAllocationEnvironment:c(e.costAllocationEnvironment),tags:W(e.tags),records:i.data,certificates:d.data};switch(t){case"route53":return l({...o,registrar:t,hostedZoneId:c(e.hostedZoneId)});case"external-delegated":{const s=c(e.delegatedSubdomain);if(s===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const f=c(e.hostedZoneId);if(e.hostedZoneId!==void 0&&f===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const h=y(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&h===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(f===void 0!=(h===void 0))return a({kind:"invalid_literal",field:f===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const S=c(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&S===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const A=_(e.phase,x);return e.phase!==void 0&&A===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${x.map(I=>`'${I}'`).join(", ")}`}):l({...o,registrar:t,delegatedSubdomain:s,hostedZoneId:f,adoptedNameServers:h,parentDelegationRoleArn:S,phase:A})}case"external-records":return l({...o,registrar:t})}}u(re,"parseDomainProps");function se(n){return B(n)}u(se,"parseDomainErrorMessage");function U(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(!g(r))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const i=G(r,t);if(!i.success)return i;e.push(i.data)}return l(e)}u(U,"parseRecordsArray");function G(n,e){const t=c(n.type),r=c(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(r===void 0)return a({kind:"missing_field",field:`records[${e}].name`});if(n.target!==void 0){if(!V.some(f=>f===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const s=H(n.target);return l({kind:"alias",type:t,name:r,target:s})}if(!P.some(s=>s===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const i=Y(n.value);if(i===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const d=$(n.ttl),o={kind:"standard",type:t,name:r,value:i,...d!==void 0?{ttl:d}:{}};return l(o)}u(G,"parseRecord");function Y(n){if(n===void 0)return;if(typeof n=="string")return n;const e=y(n);if(e!==void 0)return e}u(Y,"parseRecordValue");function H(n){if(E(n))return K(n);if(g(n)){const e=_(n.kind,C);if(e==="ecs"||e==="cdn"){const t=c(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=c(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=c(n.dnsName),r=c(n.hostedZoneId);if(t!==void 0&&r!==void 0)return{kind:e,dnsName:t,hostedZoneId:r}}}return{kind:"unresolved",sourceText:k(n)}}u(H,"parseTarget");function K(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const r=t[1],i=t[2]??"",d=v(i);switch(r){case"fjallApp":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:o}}case"fjallCdn":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:o}}case"fjallBucket":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:o}}case"aliasTo":{if(d.length>=2){const o=p(d,0),s=p(d,1);return o!==void 0&&s!==void 0?{kind:"custom",dnsName:o,hostedZoneId:s}:{kind:"dynamic",sourceText:e}}if(d.length===1){const o=d[0]?.trim()??"",s=D(o,"dnsName"),f=D(o,"hostedZoneId");return s!==void 0&&f!==void 0?{kind:"custom",dnsName:s,hostedZoneId:f}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(K,"resolveCallRefTarget");function v(n){const e=[];let t=0,r=null,i="";for(let o=0;o<n.length;o++){const s=n[o];if(r!==null){if(i+=s,s==="\\"&&o+1<n.length){const f=n[o+1];f!==void 0&&(i+=f,o+=1);continue}s===r&&(r=null);continue}if(s==='"'||s==="'"||s==="`"){r=s,i+=s;continue}if(s==="("||s==="{"||s==="["){t+=1,i+=s;continue}if(s===")"||s==="}"||s==="]"){t-=1,i+=s;continue}if(s===","&&t===0){e.push(i.trim()),i="";continue}i+=s}const d=i.trim();return d.length>0&&e.push(d),e}u(v,"splitTopLevelArgs");function p(n,e){const t=n[e];if(t===void 0)return;const r=t.trim();if(r.length<2)return;const i=r[0],d=r[r.length-1];if(i===d&&!(i!=='"'&&i!=="'"&&i!=="`"))return r.slice(1,-1)}u(p,"extractStringLiteralArg");function D(n,e){const t=n.trim().replace(/^\{|\}$/g,""),r=v(t);for(const i of r){const d=i.indexOf(":");if(d<0||i.slice(0,d).trim().replace(/["'`]/g,"")!==e)continue;const s=i.slice(d+1).trim();return p([s],0)}}u(D,"extractObjectFieldString");function Q(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const r=n[t];if(typeof r=="string"){e.push({domainName:r});continue}if(!g(r))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const i=c(r.domainName);if(i===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const d=y(r.subjectAlternativeNames),o=b(r.transparencyLogging),s=b(r.cloudFront);if(r.cloudFront!==void 0&&s===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:i,...d!==void 0?{subjectAlternativeNames:d}:{},...o!==void 0?{transparencyLogging:o}:{},...s!==void 0?{cloudFront:s}:{}})}return l(e)}u(Q,"parseCertificatesArray");function W(n){if(n===void 0||!g(n))return;const e={};for(const[t,r]of Object.entries(n)){const i=c(r);i!==void 0&&(e[t]=i)}return Object.keys(e).length===0?void 0:e}u(W,"parseStringRecord");function k(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>k(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(k,"stringifyParsedValue");export{ie as findDomainConstructCall,se as parseDomainErrorMessage,re as parseDomainProps,v as splitTopLevelArgs};
+var R=Object.defineProperty;var u=(n,e)=>R(n,"name",{value:e,configurable:!0});import*as m from"typescript";import{parseObjectLiteral as T,asString as c,asStringUnion as k,asStringArray as y,asBoolean as b,asNumber as $,isCallRef as E,isParsedObject as g}from"../parsers/common/astCommonParser.js";import{success as l,failure as a}from"../../types/Result.js";import{DnsRecordTypeSchema as L}from"../../dns/types.js";import{DomainRegistrarSchema as j,DomainDeployPhaseSchema as Z,AliasRecordTypeSchema as O,TYPED_FJALL_TARGET_KINDS as C}from"../../dns/domainRecords.js";const N=j.options,x=Z.options,P=L.options,V=O.options;function ie(n){const e=[],t=u(r=>{if(m.isNewExpression(r)&&z(r.expression)){const d=F(r);d!==void 0&&e.push(d)}m.forEachChild(r,t)},"visit");if(t(n),e.length===0)return l(void 0);if(e.length>1)return a(new Error(`Expected exactly one 'new Domain(...)' call per infrastructure file, found ${e.length}`));const s=e[0];return s?l(s):l(void 0)}u(ie,"findDomainConstructCall");function z(n){return m.isIdentifier(n)&&n.text==="Domain"}u(z,"isDomainIdentifier");function F(n){const e=n.arguments;if(!e||e.length<3)return;const t=e[0],s=e[1],r=e[2];if(!t||!s||!r||!m.isObjectLiteralExpression(r))return;const d=M(n);if(d===void 0)return;const o=q(n),i=m.isStringLiteral(s)?s.text:void 0;return{callExpression:n,containingStatement:d,propsObjectLiteral:r,domainVarId:o,scopeArgumentText:t.getText(),constructIdLiteral:i}}u(F,"buildMatch");function M(n){let e=n;for(;e!==void 0;){if(m.isExpressionStatement(e)||m.isVariableStatement(e))return e;e=e.parent}}u(M,"findContainingTopLevelStatement");function q(n){let e=n.parent;for(;e!==void 0;){if(m.isVariableDeclaration(e)&&m.isIdentifier(e.name)&&e.initializer===n)return e.name.text;e=e.parent}}u(q,"extractDomainVarId");function B(n){switch(n.kind){case"registrar_required":return"'registrar' property is required";case"registrar_unsupported":return`'registrar' must be one of ${N.join(", ")}, got ${JSON.stringify(n.value)}`;case"missing_field":return`'${n.field}' property is required`;case"invalid_literal":return`'${n.field}' ${n.reason}`;case"removed_field":return`'${n.field}' was removed from the Domain API \u2014 ${n.cure}`}}u(B,"errorMessage");const J="declare the delegated child as its own Domain with registrar: 'external-delegated' and set 'parentDelegationRoleArn' (the CLI injects it via ManagedDomainBinding.delegationRoleArn); the child UPSERTs its NS records into the parent zone";function re(n){const e=T(n),t=k(e.registrar,N);if(t===void 0){const i=e.registrar;if(i===void 0)return a({kind:"registrar_required"});const f=typeof i=="string"?i:_(i);return a({kind:"registrar_unsupported",value:f})}const s=c(e.zoneName);if(s===void 0)return a({kind:"missing_field",field:"zoneName"});const r=U(e.records);if(!r.success)return r;const d=Q(e.certificates);if(!d.success)return d;if(e.delegations!==void 0)return a({kind:"removed_field",field:"delegations",cure:J});const o={zoneName:s,description:c(e.description),costAllocationEnvironment:c(e.costAllocationEnvironment),tags:W(e.tags),records:r.data,certificates:d.data};switch(t){case"route53":return l({...o,registrar:t,hostedZoneId:c(e.hostedZoneId)});case"external-delegated":{const i=c(e.delegatedSubdomain);if(i===void 0)return a({kind:"missing_field",field:"delegatedSubdomain"});const f=c(e.hostedZoneId);if(e.hostedZoneId!==void 0&&f===void 0)return a({kind:"invalid_literal",field:"hostedZoneId",reason:"must be a literal string zone id on external-delegated \u2014 dynamic expressions cannot be round-tripped"});const h=y(e.adoptedNameServers);if(e.adoptedNameServers!==void 0&&h===void 0)return a({kind:"invalid_literal",field:"adoptedNameServers",reason:"must be an array of literal NS hostname strings \u2014 the parent NS UPSERT writes them verbatim"});if(f===void 0!=(h===void 0))return a({kind:"invalid_literal",field:f===void 0?"hostedZoneId":"adoptedNameServers",reason:"adopting an existing child zone requires hostedZoneId and adoptedNameServers together (both-or-neither) \u2014 an imported zone exposes no name-server attribute at synth"});const S=c(e.parentDelegationRoleArn);if(e.parentDelegationRoleArn!==void 0&&S===void 0)return a({kind:"invalid_literal",field:"parentDelegationRoleArn",reason:"must be a literal string ARN (VD2-a) \u2014 the CLI injects it via ManagedDomainBinding.delegationRoleArn; dynamic expressions such as Fn.importValue are not supported"});const A=k(e.phase,x);return e.phase!==void 0&&A===void 0?a({kind:"invalid_literal",field:"phase",reason:`must be one of ${x.map(I=>`'${I}'`).join(", ")}`}):l({...o,registrar:t,delegatedSubdomain:i,hostedZoneId:f,adoptedNameServers:h,parentDelegationRoleArn:S,phase:A})}case"external-records":return l({...o,registrar:t})}}u(re,"parseDomainProps");function se(n){return B(n)}u(se,"parseDomainErrorMessage");function U(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"records",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const s=n[t];if(!g(s))return a({kind:"invalid_literal",field:`records[${t}]`,reason:"must be an object literal"});const r=G(s,t);if(!r.success)return r;e.push(r.data)}return l(e)}u(U,"parseRecordsArray");function G(n,e){const t=c(n.type),s=c(n.name);if(t===void 0)return a({kind:"missing_field",field:`records[${e}].type`});if(s===void 0)return a({kind:"missing_field",field:`records[${e}].name`});if(n.target!==void 0){if(!V.some(f=>f===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`alias records must have type 'A' or 'AAAA', got '${t}'`});const i=H(n.target);return l({kind:"alias",type:t,name:s,target:i})}if(!P.some(i=>i===t))return a({kind:"invalid_literal",field:`records[${e}]`,reason:`unsupported record type '${t}'`});const r=Y(n.value);if(r===void 0)return a({kind:"invalid_literal",field:`records[${e}].value`,reason:`must be a string or array of strings (got ${JSON.stringify(n.value)})`});const d=$(n.ttl),o={kind:"standard",type:t,name:s,value:r,...d!==void 0?{ttl:d}:{}};return l(o)}u(G,"parseRecord");function Y(n){if(n===void 0)return;if(typeof n=="string")return n;const e=y(n);if(e!==void 0)return e}u(Y,"parseRecordValue");function H(n){if(E(n))return K(n);if(g(n)){const e=k(n.kind,C);if(e==="ecs"||e==="cdn"){const t=c(n.appName);if(t!==void 0)return{kind:e,appName:t}}if(e==="bucket"){const t=c(n.bucketName);if(t!==void 0)return{kind:e,bucketName:t}}if(e==="custom"){const t=c(n.dnsName),s=c(n.hostedZoneId);if(t!==void 0&&s!==void 0)return{kind:e,dnsName:t,hostedZoneId:s}}}return{kind:"unresolved",sourceText:_(n)}}u(H,"parseTarget");function K(n){const e=n.__call.trim(),t=e.match(/^([A-Za-z_][\w$]*)\s*\(([\s\S]*)\)\s*$/);if(!t)return{kind:"unresolved",sourceText:e};const s=t[1],r=t[2]??"",d=v(r);switch(s){case"fjallApp":{const o=p(d,0);if(o===void 0)return{kind:"dynamic",sourceText:e};if(d.length<2)return{kind:"ecs",appName:o};const i=p(d,1);return i===void 0?{kind:"dynamic",sourceText:e}:{kind:"ecs",appName:o,computeName:i}}case"fjallCdn":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"cdn",appName:o}}case"fjallBucket":{const o=p(d,0);return o===void 0?{kind:"dynamic",sourceText:e}:{kind:"bucket",bucketName:o}}case"aliasTo":{if(d.length>=2){const o=p(d,0),i=p(d,1);return o!==void 0&&i!==void 0?{kind:"custom",dnsName:o,hostedZoneId:i}:{kind:"dynamic",sourceText:e}}if(d.length===1){const o=d[0]?.trim()??"",i=D(o,"dnsName"),f=D(o,"hostedZoneId");return i!==void 0&&f!==void 0?{kind:"custom",dnsName:i,hostedZoneId:f}:{kind:"dynamic",sourceText:e}}return{kind:"unresolved",sourceText:e}}default:return{kind:"unresolved",sourceText:e}}}u(K,"resolveCallRefTarget");function v(n){const e=[];let t=0,s=null,r="";for(let o=0;o<n.length;o++){const i=n[o];if(s!==null){if(r+=i,i==="\\"&&o+1<n.length){const f=n[o+1];f!==void 0&&(r+=f,o+=1);continue}i===s&&(s=null);continue}if(i==='"'||i==="'"||i==="`"){s=i,r+=i;continue}if(i==="("||i==="{"||i==="["){t+=1,r+=i;continue}if(i===")"||i==="}"||i==="]"){t-=1,r+=i;continue}if(i===","&&t===0){e.push(r.trim()),r="";continue}r+=i}const d=r.trim();return d.length>0&&e.push(d),e}u(v,"splitTopLevelArgs");function p(n,e){const t=n[e];if(t===void 0)return;const s=t.trim();if(s.length<2)return;const r=s[0],d=s[s.length-1];if(r===d&&!(r!=='"'&&r!=="'"&&r!=="`"))return s.slice(1,-1)}u(p,"extractStringLiteralArg");function D(n,e){const t=n.trim().replace(/^\{|\}$/g,""),s=v(t);for(const r of s){const d=r.indexOf(":");if(d<0||r.slice(0,d).trim().replace(/["'`]/g,"")!==e)continue;const i=r.slice(d+1).trim();return p([i],0)}}u(D,"extractObjectFieldString");function Q(n){if(n===void 0)return l([]);if(!Array.isArray(n))return a({kind:"invalid_literal",field:"certificates",reason:"must be an array"});const e=[];for(let t=0;t<n.length;t++){const s=n[t];if(typeof s=="string"){e.push({domainName:s});continue}if(!g(s))return a({kind:"invalid_literal",field:`certificates[${t}]`,reason:"must be a string or object literal"});const r=c(s.domainName);if(r===void 0)return a({kind:"missing_field",field:`certificates[${t}].domainName`});const d=y(s.subjectAlternativeNames),o=b(s.transparencyLogging),i=b(s.cloudFront);if(s.cloudFront!==void 0&&i===void 0)return a({kind:"invalid_literal",field:`certificates[${t}].cloudFront`,reason:"must be a boolean literal \u2014 the CloudFront designation drives the zone-level us-east-1 export contract and cannot be round-tripped from a dynamic expression"});e.push({domainName:r,...d!==void 0?{subjectAlternativeNames:d}:{},...o!==void 0?{transparencyLogging:o}:{},...i!==void 0?{cloudFront:i}:{}})}return l(e)}u(Q,"parseCertificatesArray");function W(n){if(n===void 0||!g(n))return;const e={};for(const[t,s]of Object.entries(n)){const r=c(s);r!==void 0&&(e[t]=r)}return Object.keys(e).length===0?void 0:e}u(W,"parseStringRecord");function _(n){if(n===void 0)return"undefined";if(n===null)return"null";if(typeof n=="string")return JSON.stringify(n);if(typeof n=="number"||typeof n=="boolean")return String(n);if(Array.isArray(n))return`[${n.map(e=>_(e)).join(", ")}]`;if(typeof n=="object"){if("__call"in n)return String(n.__call);if("__identifier"in n)return String(n.__identifier);if("__expression"in n)return String(n.__expression);if("__unknown"in n)return String(n.__unknown)}return String(n)}u(_,"stringifyParsedValue");export{ie as findDomainConstructCall,se as parseDomainErrorMessage,re as parseDomainProps,v as splitTopLevelArgs};

package/dist/src/codemod/drift/snapshot.js

@@ -1 +1 @@
-var h=Object.defineProperty;var u=(r,t)=>h(r,"name",{value:t,configurable:!0});import{failure as d,success as g}from"../../types/Result.js";import{extractProgramBody as k,isRecord as m}from"../_internal.js";import{astToLiteral as b,isNodeShape as y,NON_LITERAL as E,readKeyName as x}from"../edits/modifyResource/literalConversion.js";import{parse as N}from"../fileRewriter/index.js";import{listResources as O}from"../listResources.js";import{STATEMENT_REGISTRY as j}from"../registry.js";function I(r,t,n){const e=O(r);if(!e.success)return d(e.error);const i=e.data.resources.find(o=>o.type===t&&o.name===n);if(i===void 0)return d({kind:"ResourceNotFoundError",type:t,name:n,knownNames:e.data.resources.filter(o=>o.type===t).map(o=>o.name)});const s=N(r,i.filePath);if(!s.success)return d(s.error);const c=k(s.data);if(c===void 0)return d({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const f=S(c,i);if(f===void 0)return d({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const a=new Set(Object.keys(j[t].schemaFragment.shape)),l={};for(const o of f.properties){if(o.type!=="Property"&&o.type!=="ObjectProperty"||o.shorthand===!0||o.computed===!0)continue;const p=x(o.key);p===void 0||!a.has(p)||o.value!==void 0&&(l[p]=v(o.value,r))}return g({type:t,name:n,properties:l,schemaVersion:1})}u(I,"snapshotProperties");function S(r,t){const n=t.start+t.length;let e;const i=u(s=>{if(e!==void 0||s.type!=="CallExpression")return;const c=s.arguments;if(!Array.isArray(c)||c.length<2)return;const f=c[0];if(!y(f)||f.type!=="StringLiteral"||f.start!==t.start||f.end!==n)return;const a=c[1];y(a)&&a.type==="ObjectExpression"&&(e=a)},"visitor");for(const s of r)if(P(s,i),e!==void 0)break;return e}u(S,"findConfigObject");function v(r,t){const n=b(r);return n!==E?n:A(r,t)}u(v,"extractPropertyValue");function A(r,t){const n=typeof r.start=="number"?r.start:void 0,e=typeof r.end=="number"?r.end:void 0;return{kind:"expression",text:n!==void 0&&e!==void 0&&n<e?t.slice(n,e):""}}u(A,"toExpressionValue");function P(r,t){const n=[r];for(;n.length>0;){const e=n.pop();if(m(e)){typeof e.type=="string"&&t(e);for(const i of Object.keys(e)){if(i==="loc"||i==="comments"||i==="tokens")continue;const s=e[i];if(Array.isArray(s))for(const c of s)m(c)&&n.push(c);else m(s)&&n.push(s)}}}}u(P,"visit");export{I as snapshotProperties};
+var y=Object.defineProperty;var u=(e,r)=>y(e,"name",{value:r,configurable:!0});import{failure as d,success as h}from"../../types/Result.js";import{extractProgramBody as b}from"../_internal.js";import{astToLiteral as g,isNodeShape as l,NON_LITERAL as E,readKeyName as k}from"../edits/modifyResource/literalConversion.js";import{visit as x}from"../edits/objectGraph.js";import{parse as N}from"../fileRewriter/index.js";import{listResources as O}from"../listResources.js";import{STATEMENT_REGISTRY as S}from"../registry.js";function I(e,r,o){const n=O(e);if(!n.success)return d(n.error);const f=n.data.resources.find(t=>t.type===r&&t.name===o);if(f===void 0)return d({kind:"ResourceNotFoundError",type:r,name:o,knownNames:n.data.resources.filter(t=>t.type===r).map(t=>t.name)});const s=N(e,f.filePath);if(!s.success)return d(s.error);const i=b(s.data);if(i===void 0)return d({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const c=j(i,f);if(c===void 0)return d({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const a=new Set(Object.keys(S[r].schemaFragment.shape)),m={};for(const t of c.properties){if(t.type!=="Property"&&t.type!=="ObjectProperty"||t.shorthand===!0||t.computed===!0)continue;const p=k(t.key);p===void 0||!a.has(p)||t.value!==void 0&&(m[p]=P(t.value,e))}return h({type:r,name:o,properties:m,schemaVersion:1})}u(I,"snapshotProperties");function j(e,r){const o=r.start+r.length;let n;const f=u(s=>{if(n!==void 0||s.type!=="CallExpression")return;const i=s.arguments;if(!Array.isArray(i)||i.length<2)return;const c=i[0];if(!l(c)||c.type!=="StringLiteral"||c.start!==r.start||c.end!==o)return;const a=i[1];l(a)&&a.type==="ObjectExpression"&&(n=a)},"visitor");for(const s of e)if(x(s,f),n!==void 0)break;return n}u(j,"findConfigObject");function P(e,r){const o=g(e);return o!==E?o:T(e,r)}u(P,"extractPropertyValue");function T(e,r){const o=typeof e.start=="number"?e.start:void 0,n=typeof e.end=="number"?e.end:void 0;return{kind:"expression",text:o!==void 0&&n!==void 0&&o<n?r.slice(o,n):""}}u(T,"toExpressionValue");export{I as snapshotProperties};

package/dist/src/codemod/edits/appendAccountToStage.js

@@ -1 +1 @@
-var T=Object.defineProperty;var u=(e,r)=>T(e,"name",{value:r,configurable:!0});import{failure as d,success as y}from"../../types/Result.js";import{DEFAULT_FILE_PATH as x,computeLinesDelta as k,extractProgramBody as b}from"../_internal.js";import{buildObjectProperty as h,detectQuoteStyle as D,parse as C,printFile as F}from"../fileRewriter/index.js";import{makeStringLiteral as L,toAstValue as w}from"./addResource/propertyBuilder.js";import{astToLiteral as I,isNodeShape as f,readKeyName as g}from"./modifyResource/literalConversion.js";const K="ACCOUNTS",O="workloads";function J(e,r){const n=r.filePath??x,t=r.constName??K,a=r.nestedKey??O,{stage:i,displayName:o}=r,s=C(e,n);if(!s.success)return d(s.error);const l=b(s.data);if(l===void 0)return d({kind:"InvalidStageTargetError",stage:i,reason:"recast File is missing program.body"});const m=$(l,t);if(m===void 0)return d({kind:"ConstNotFoundError",constName:t});const p=D(s.data),c=V(m,{constName:t,stage:i,nestedKey:a,displayName:o,quoteStyle:p});if(!c.success)return d(c.error);if(c.data.created)return P(s.data,e);const v=c.data.array;return v.elements.some(N=>f(N)&&I(N)===o)?y({content:e,linesChanged:{added:0,removed:0},skipped:!0}):(v.elements.push(L(o,p)),P(s.data,e))}u(J,"appendAccountToStage");function P(e,r){const n=F(e,r);return y({content:n,linesChanged:k(r,n)})}u(P,"printSuccess");function V(e,r){const{constName:n,stage:t,nestedKey:a,displayName:i,quoteStyle:o}=r,s=E(e,t);if(s!==void 0)return A(s.value)?y({created:!1,array:s.value}):d({kind:"InvalidStageTargetError",stage:t,reason:`Top-level "${t}" is not an array literal.`});const l=E(e,a);if(l!==void 0&&S(l.value)){const m=l.value,p=E(m,t);if(p!==void 0)return A(p.value)?y({created:!1,array:p.value}):d({kind:"InvalidStageTargetError",stage:t,reason:`Nested "${a}.${t}" is not an array literal.`});const c=_(m,t,i,o);return c.success?y({created:!0}):d(c.error)}return d({kind:"StageNotFoundError",constName:n,stage:t,knownStages:B(e,a)})}u(V,"resolveStageArray");function _(e,r,n,t){const a=w([n],t);if(a===void 0)return d({kind:"InvalidStageTargetError",stage:r,reason:`Unable to build an array literal for "${r}".`});const i=h(r,a,t);return e.properties[e.properties.length-1]?.extra?.trailingComma===!0&&(i.extra={...i.extra??{},trailingComma:!0}),e.properties.push(i),y(void 0)}u(_,"appendStageProperty");function $(e,r){for(const n of e){const t=U(n);if(t===void 0)continue;const a=t.declarations;if(Array.isArray(a))for(const i of a){if(!f(i)||i.type!=="VariableDeclarator")continue;const o=i.id,s=j(i.init);if(f(o)&&o.type==="Identifier"&&o.name===r&&S(s))return s}}}u($,"findConstObjectExpression");function U(e){if(e.type==="VariableDeclaration")return e;if(e.type==="ExportNamedDeclaration"){const r=e.declaration;if(f(r)&&r.type==="VariableDeclaration")return r}}u(U,"unwrapVariableDeclaration");function j(e){let r=e;for(;f(r)&&(r.type==="TSAsExpression"||r.type==="TSSatisfiesExpression");)r=r.expression;return r}u(j,"unwrapExpression");function E(e,r){return e.properties.find(n=>(n.type==="Property"||n.type==="ObjectProperty")&&n.shorthand!==!0&&n.computed!==!0&&g(n.key)===r)}u(E,"findPropertyByKey");function B(e,r){const n=[];for(const t of e.properties){if(t.type!=="Property"&&t.type!=="ObjectProperty")continue;const a=g(t.key);if(a!==void 0)if(a===r&&S(t.value))for(const i of t.value.properties){const o=g(i.key);o!==void 0&&n.push(`${r}.${o}`)}else A(t.value)&&n.push(a)}return n}u(B,"collectStageKeys");function S(e){return f(e)&&e.type==="ObjectExpression"&&Array.isArray(e.properties)}u(S,"isObjectExpression");function A(e){return f(e)&&e.type==="ArrayExpression"&&Array.isArray(e.elements)}u(A,"isArrayExpression");export{J as appendAccountToStage};
+var x=Object.defineProperty;var u=(e,r)=>x(e,"name",{value:r,configurable:!0});import{failure as d,success as y}from"../../types/Result.js";import{DEFAULT_FILE_PATH as P,computeLinesDelta as k,extractProgramBody as b}from"../_internal.js";import{buildObjectProperty as h,detectQuoteStyle as D,parse as C,printFile as F}from"../fileRewriter/index.js";import{makeStringLiteral as L,toAstValue as w}from"./addResource/propertyBuilder.js";import{astToLiteral as I,isNodeShape as l,readKeyName as N}from"./modifyResource/literalConversion.js";import{findPropertyByKey as g}from"./objectGraph.js";const K="ACCOUNTS",V="workloads";function R(e,r){const i=r.filePath??P,t=r.constName??K,n=r.nestedKey??V,{stage:a,displayName:o}=r,s=C(e,i);if(!s.success)return d(s.error);const f=b(s.data);if(f===void 0)return d({kind:"InvalidStageTargetError",stage:a,reason:"recast File is missing program.body"});const m=O(f,t);if(m===void 0)return d({kind:"ConstNotFoundError",constName:t});const p=D(s.data),c=_(m,{constName:t,stage:a,nestedKey:n,displayName:o,quoteStyle:p});if(!c.success)return d(c.error);if(c.data.created)return T(s.data,e);const A=c.data.array;return A.elements.some(v=>l(v)&&I(v)===o)?y({content:e,linesChanged:{added:0,removed:0},skipped:!0}):(A.elements.push(L(o,p)),T(s.data,e))}u(R,"appendAccountToStage");function T(e,r){const i=F(e,r);return y({content:i,linesChanged:k(r,i)})}u(T,"printSuccess");function _(e,r){const{constName:i,stage:t,nestedKey:n,displayName:a,quoteStyle:o}=r,s=g(e,t);if(s!==void 0)return S(s.value)?y({created:!1,array:s.value}):d({kind:"InvalidStageTargetError",stage:t,reason:`Top-level "${t}" is not an array literal.`});const f=g(e,n);if(f!==void 0&&E(f.value)){const m=f.value,p=g(m,t);if(p!==void 0)return S(p.value)?y({created:!1,array:p.value}):d({kind:"InvalidStageTargetError",stage:t,reason:`Nested "${n}.${t}" is not an array literal.`});const c=$(m,t,a,o);return c.success?y({created:!0}):d(c.error)}return d({kind:"StageNotFoundError",constName:i,stage:t,knownStages:B(e,n)})}u(_,"resolveStageArray");function $(e,r,i,t){const n=w([i],t);if(n===void 0)return d({kind:"InvalidStageTargetError",stage:r,reason:`Unable to build an array literal for "${r}".`});const a=h(r,n,t);return e.properties[e.properties.length-1]?.extra?.trailingComma===!0&&(a.extra={...a.extra??{},trailingComma:!0}),e.properties.push(a),y(void 0)}u($,"appendStageProperty");function O(e,r){for(const i of e){const t=U(i);if(t===void 0)continue;const n=t.declarations;if(Array.isArray(n))for(const a of n){if(!l(a)||a.type!=="VariableDeclarator")continue;const o=a.id,s=j(a.init);if(l(o)&&o.type==="Identifier"&&o.name===r&&E(s))return s}}}u(O,"findConstObjectExpression");function U(e){if(e.type==="VariableDeclaration")return e;if(e.type==="ExportNamedDeclaration"){const r=e.declaration;if(l(r)&&r.type==="VariableDeclaration")return r}}u(U,"unwrapVariableDeclaration");function j(e){let r=e;for(;l(r)&&(r.type==="TSAsExpression"||r.type==="TSSatisfiesExpression");)r=r.expression;return r}u(j,"unwrapExpression");function B(e,r){const i=[];for(const t of e.properties){if(t.type!=="Property"&&t.type!=="ObjectProperty")continue;const n=N(t.key);if(n!==void 0)if(n===r&&E(t.value))for(const a of t.value.properties){const o=N(a.key);o!==void 0&&i.push(`${r}.${o}`)}else S(t.value)&&i.push(n)}return i}u(B,"collectStageKeys");function E(e){return l(e)&&e.type==="ObjectExpression"&&Array.isArray(e.properties)}u(E,"isObjectExpression");function S(e){return l(e)&&e.type==="ArrayExpression"&&Array.isArray(e.elements)}u(S,"isArrayExpression");export{R as appendAccountToStage};

package/dist/src/codemod/edits/modifyResource.js

@@ -1 +1 @@
-var T=Object.defineProperty;var u=(r,e)=>T(r,"name",{value:e,configurable:!0});import{failure as s,success as y}from"../../types/Result.js";import{DEFAULT_FILE_PATH as A,computeLinesDelta as F,extractProgramBody as L,isRecord as g}from"../_internal.js";import{buildObjectProperty as G,detectQuoteStyle as O,parse as Q,printFile as U}from"../fileRewriter/index.js";import{STATEMENT_REGISTRY as b}from"../registry.js";import{locateAllShapes as I,locateByShape as D}from"../semanticIndex/index.js";import{buildUnmanagedEditRefusal as K}from"./unmanagedShapeErrors.js";import{checkControlFlowPolicy as V}from"./controlFlowPolicy.js";import{driftGate as B,runPipeline as _,schemaGate as M}from"../validationGate/index.js";import{toAstValue as $}from"./addResource/propertyBuilder.js";import{buildMergedLiteral as v,collectPropertyKeys as H,isNodeShape as S,readKeyName as Y}from"./modifyResource/literalConversion.js";import{evaluateEmitGuard as q,UNRESOLVED as z}from"../emitGuard.js";import{projectEmittedProperties as J,projectionRefusal as W}from"../emitProjection.js";function he(r,e,t={}){const n=e.filePath??A,i=Q(r,n);if(!i.success)return s(i.error);const a=D(r,{type:e.type,name:e.name},n);if(!a.success)return a.error.kind==="TemplateLiteralNameError"?s(a.error):s({kind:"SemanticQueryError",reason:a.error.reason,cause:a.error.cause});if(a.data===void 0)return s({kind:"ResourceNotFoundError",type:e.type,name:e.name,knownNames:ne(r,e.type,n)});if(a.data.managed===!1)return s(K(e.type,"modify"));const o=V({ast:i.data,target:a.data,resource:{type:e.type,name:e.name},op:"modify"});if(o.refusal!==void 0)return s(o.refusal);const c=_([M,B],{content:r,plan:{type:e.type,name:e.name,properties:e.properties,op:"modify"},baseline:t.baseline,policy:e.driftPolicy});if(!c.success)return s(X(c.error));if(c.data.action==="skip")return y({content:r,linesChanged:{added:0,removed:0},skipped:!0});const d=L(i.data);if(d===void 0)return s({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const l=Z(d,a.data);if(l===void 0)return s({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const R=O(i.data),x=v(l,e.properties),C=b[e.type].emitGuard,E=u(f=>q(C,f)??W(e.type,f),"judge"),N=E(w(l,v(l,{}))),p=E(w(l,x));if(p!==void 0&&p.property!==N?.property)return s(p);const h=b[e.type].schemaFragment.safeParse(e.properties);if(!h.success){const f=h.error.issues[0];return s({kind:"InvalidPropertyError",property:f!==void 0&&f.path.length>0?String(f.path[0]):Object.keys(e.properties)[0]??"<unknown>",reason:f?.message??"Schema validation failed"})}const m=J(e.type,e.properties,{editingExisting:!0});if("refusal"in m)return s(m.refusal);const k=ee(l,m.props,R);if(!k.success)return s(k.error);const P=U(i.data,r),j=o.warning!==void 0?[o.warning.message]:void 0;return y({content:P,linesChanged:F(r,P),warnings:j})}u(he,"modifyResource");function w(r,e){const t={...e};for(const n of H(r))n in t||(t[n]=z);return t}u(w,"buildGuardView");function X(r){switch(r.kind){case"ParseError":case"ResourceNotFoundError":case"InvalidPropertyError":case"TemplateLiteralNameError":case"SemanticQueryError":case"DriftConflictError":case"ControlFlowClassifierError":return r;default:return{kind:"SemanticQueryError",reason:`Unexpected codemod error in validation-gate pipeline: ${r.kind}`}}}u(X,"narrowGateError");function Z(r,e){const t=e.start+e.length;let n;const i=u(a=>{if(n!==void 0||a.type!=="CallExpression")return;const o=a.arguments;if(!Array.isArray(o)||o.length<2)return;const c=o[0];if(!S(c)||c.type!=="StringLiteral"||c.start!==e.start||c.end!==t)return;const d=o[1];S(d)&&d.type==="ObjectExpression"&&(n=d)},"visitor");for(const a of r)if(ie(a,i),n!==void 0)break;return n}u(Z,"findConfigObject");function ee(r,e,t){const n=te(r);for(const{key:i,value:a}of e){const o=$(a,t);if(o===void 0)return s({kind:"InvalidPropertyError",property:i,reason:`Unsupported property value for "${i}" (accepts string/number/boolean/null/array/object of the same).`});const c=re(r,i);if(c!==void 0){c.value=o;continue}const d=G(i,o,t);n&&(d.extra={...d.extra??{},trailingComma:!0}),r.properties.push(d)}return y(void 0)}u(ee,"applyPropertyEdits");function re(r,e){return r.properties.find(t=>(t.type==="Property"||t.type==="ObjectProperty")&&t.shorthand!==!0&&t.computed!==!0&&Y(t.key)===e)}u(re,"findPropertyByKey");function te(r){return r.properties[r.properties.length-1]?.extra?.trailingComma===!0}u(te,"detectTrailingCommaStyle");function ne(r,e,t){const n=I(r,t);return n.success?n.data.filter(i=>i.type===e).map(i=>i.symbolName):[]}u(ne,"collectKnownNames");function ie(r,e){const t=[r];for(;t.length>0;){const n=t.pop();if(g(n)){typeof n.type=="string"&&e(n);for(const i of Object.keys(n)){if(i==="loc"||i==="comments"||i==="tokens")continue;const a=n[i];if(Array.isArray(a))for(const o of a)g(o)&&t.push(o);else g(a)&&t.push(a)}}}}u(ie,"visit");export{he as modifyResource};
+var T=Object.defineProperty;var d=(r,e)=>T(r,"name",{value:e,configurable:!0});import{failure as i,success as y}from"../../types/Result.js";import{DEFAULT_FILE_PATH as F,computeLinesDelta as L,extractProgramBody as j}from"../_internal.js";import{buildObjectProperty as A,detectQuoteStyle as G,parse as Q,printFile as U}from"../fileRewriter/index.js";import{STATEMENT_REGISTRY as P}from"../registry.js";import{locateAllShapes as I,locateByShape as D}from"../semanticIndex/index.js";import{buildUnmanagedEditRefusal as O}from"./unmanagedShapeErrors.js";import{checkControlFlowPolicy as V}from"./controlFlowPolicy.js";import{driftGate as B,runPipeline as K,schemaGate as _}from"../validationGate/index.js";import{toAstValue as M}from"./addResource/propertyBuilder.js";import{buildMergedLiteral as b,collectPropertyKeys as $,isNodeShape as S}from"./modifyResource/literalConversion.js";import{findPropertyByKey as H,visit as Y}from"./objectGraph.js";import{evaluateEmitGuard as q,UNRESOLVED as z}from"../emitGuard.js";import{projectEmittedProperties as J,projectionRefusal as W}from"../emitProjection.js";function Ee(r,e,s={}){const n=e.filePath??F,t=Q(r,n);if(!t.success)return i(t.error);const a=D(r,{type:e.type,name:e.name},n);if(!a.success)return a.error.kind==="TemplateLiteralNameError"?i(a.error):i({kind:"SemanticQueryError",reason:a.error.reason,cause:a.error.cause});if(a.data===void 0)return i({kind:"ResourceNotFoundError",type:e.type,name:e.name,knownNames:te(r,e.type,n)});if(a.data.managed===!1)return i(O(e.type,"modify"));const o=V({ast:t.data,target:a.data,resource:{type:e.type,name:e.name},op:"modify"});if(o.refusal!==void 0)return i(o.refusal);const u=K([_,B],{content:r,plan:{type:e.type,name:e.name,properties:e.properties,op:"modify"},baseline:s.baseline,policy:e.driftPolicy});if(!u.success)return i(X(u.error));if(u.data.action==="skip")return y({content:r,linesChanged:{added:0,removed:0},skipped:!0});const c=j(t.data);if(c===void 0)return i({kind:"SemanticQueryError",reason:"recast File is missing program.body"});const f=Z(c,a.data);if(f===void 0)return i({kind:"SemanticQueryError",reason:"Unable to resolve config ObjectExpression for the located resource."});const w=G(t.data),x=b(f,e.properties),C=P[e.type].emitGuard,g=d(l=>q(C,l)??W(e.type,l),"judge"),R=g(v(f,b(f,{}))),p=g(v(f,x));if(p!==void 0&&p.property!==R?.property)return i(p);const E=P[e.type].schemaFragment.safeParse(e.properties);if(!E.success){const l=E.error.issues[0];return i({kind:"InvalidPropertyError",property:l!==void 0&&l.path.length>0?String(l.path[0]):Object.keys(e.properties)[0]??"<unknown>",reason:l?.message??"Schema validation failed"})}const m=J(e.type,e.properties,{editingExisting:!0});if("refusal"in m)return i(m.refusal);const h=ee(f,m.props,w);if(!h.success)return i(h.error);const k=U(t.data,r),N=o.warning!==void 0?[o.warning.message]:void 0;return y({content:k,linesChanged:L(r,k),warnings:N})}d(Ee,"modifyResource");function v(r,e){const s={...e};for(const n of $(r))n in s||(s[n]=z);return s}d(v,"buildGuardView");function X(r){switch(r.kind){case"ParseError":case"ResourceNotFoundError":case"InvalidPropertyError":case"TemplateLiteralNameError":case"SemanticQueryError":case"DriftConflictError":case"ControlFlowClassifierError":return r;default:return{kind:"SemanticQueryError",reason:`Unexpected codemod error in validation-gate pipeline: ${r.kind}`}}}d(X,"narrowGateError");function Z(r,e){const s=e.start+e.length;let n;const t=d(a=>{if(n!==void 0||a.type!=="CallExpression")return;const o=a.arguments;if(!Array.isArray(o)||o.length<2)return;const u=o[0];if(!S(u)||u.type!=="StringLiteral"||u.start!==e.start||u.end!==s)return;const c=o[1];S(c)&&c.type==="ObjectExpression"&&(n=c)},"visitor");for(const a of r)if(Y(a,t),n!==void 0)break;return n}d(Z,"findConfigObject");function ee(r,e,s){const n=re(r);for(const{key:t,value:a}of e){const o=M(a,s);if(o===void 0)return i({kind:"InvalidPropertyError",property:t,reason:`Unsupported property value for "${t}" (accepts string/number/boolean/null/array/object of the same).`});const u=H(r,t);if(u!==void 0){u.value=o;continue}const c=A(t,o,s);n&&(c.extra={...c.extra??{},trailingComma:!0}),r.properties.push(c)}return y(void 0)}d(ee,"applyPropertyEdits");function re(r){return r.properties[r.properties.length-1]?.extra?.trailingComma===!0}d(re,"detectTrailingCommaStyle");function te(r,e,s){const n=I(r,s);return n.success?n.data.filter(t=>t.type===e).map(t=>t.symbolName):[]}d(te,"collectKnownNames");export{Ee as modifyResource};

package/dist/src/codemod/edits/moduleConstResolver.d.ts

@@ -0,0 +1,24 @@
+import { type NodeShapeLike } from "./modifyResource/literalConversion.js";
+export interface ModuleConstResolver {
+    /**
+     * Strings of `const NAME = ["A", "B"] as const`. `undefined` when NAME is
+     * not a uniquely-bound module-scope const initialised to a flat array of
+     * string literals (nested spreads do not resolve).
+     */
+    resolveStringArray(name: string): readonly string[] | undefined;
+    /** Value of `const NAME = "A"`; `undefined` when not uniquely so bound. */
+    resolveString(name: string): string | undefined;
+    /**
+     * Statically-known keys of the object a node denotes: an object literal
+     * (following nested same-file spreads) or an identifier naming a
+     * uniquely-bound module-scope const object. `undefined` when any key is
+     * computed or any spread does not resolve.
+     */
+    objectKeysOf(node: NodeShapeLike): readonly string[] | undefined;
+}
+export declare function buildModuleConstResolver(body: NodeShapeLike[]): ModuleConstResolver;
+/**
+ * The string a node statically denotes: a string literal or an
+ * expressionless template literal. `undefined` for anything else.
+ */
+export declare function readStaticString(node: NodeShapeLike): string | undefined;

package/dist/src/codemod/edits/moduleConstResolver.js

@@ -0,0 +1 @@
+var b=Object.defineProperty;var f=(a,r)=>b(a,"name",{value:r,configurable:!0});import{isRecord as l}from"../_internal.js";import{isNodeShape as d,readKeyName as S}from"./modifyResource/literalConversion.js";function w(a){const r=k(a),s=x(a),t=f(n=>r.get(n)===1?s.get(n):void 0,"initFor");return{resolveString(n){const e=t(n);return e===void 0?void 0:g(e)},resolveStringArray(n){const e=t(n);if(e===void 0)return;const i=y(e);if(i.type!=="ArrayExpression")return;const o=i.elements;if(!Array.isArray(o))return;const u=[];for(const p of o){if(!d(p))return;const A=g(p);if(A===void 0)return;u.push(A)}return u},objectKeysOf:f(n=>m(n,t,new Set),"objectKeysOf")}}f(w,"buildModuleConstResolver");function g(a){const r=y(a);if(r.type==="StringLiteral"){const s=r.value;return typeof s=="string"?s:void 0}if(r.type==="TemplateLiteral"){const s=r.expressions,t=r.quasis;if(!Array.isArray(s)||s.length!==0||!Array.isArray(t)||t.length!==1)return;const[c]=t;return!l(c)||!l(c.value)?void 0:typeof c.value.cooked=="string"?c.value.cooked:void 0}}f(g,"readStaticString");const h=new Set(["TSAsExpression","TSSatisfiesExpression","TSTypeAssertion","TSNonNullExpression","ParenthesizedExpression"]);function y(a){let r=a;for(;h.has(r.type);){const s=r.expression;if(!d(s))return r;r=s}return r}f(y,"unwrapTsWrappers");function m(a,r,s){const t=y(a);if(t.type==="Identifier"){const e=t.name;if(typeof e!="string"||s.has(e))return;s.add(e);const i=r(e);return i===void 0?void 0:m(i,r,s)}if(t.type!=="ObjectExpression")return;const c=t.properties;if(!Array.isArray(c))return;const n=[];for(const e of c){if(!d(e))return;if(e.type==="SpreadElement"||e.type==="SpreadProperty"){const u=e.argument;if(!d(u))return;const p=m(u,r,s);if(p===void 0)return;n.push(...p);continue}if(e.type!=="Property"&&e.type!=="ObjectProperty"&&e.type!=="ObjectMethod"||e.computed===!0)return;const i=e.key;if(!d(i))return;const o=S(i);if(o===void 0)return;n.push(o)}return n}f(m,"objectKeysOfNode");function k(a){const r=new Map,s=f(n=>{r.set(n,(r.get(n)??0)+1)},"bump"),t=f(n=>{if(d(n))switch(n.type){case"Identifier":{const e=n.name;typeof e=="string"&&s(e);return}case"ObjectPattern":{const e=n.properties;if(!Array.isArray(e))return;for(const i of e)d(i)&&(i.type==="RestElement"||i.type==="RestProperty"?t(i.argument):t(i.value));return}case"ArrayPattern":{const e=n.elements;if(!Array.isArray(e))return;for(const i of e)t(i);return}case"AssignmentPattern":t(n.left);return;case"RestElement":t(n.argument);return;case"TSParameterProperty":t(n.parameter);return;default:return}},"bumpPattern"),c=f(n=>{const e=[n];for(;e.length>0;){const i=e.pop();if(l(i)){if(typeof i.type=="string"){const o=i;switch(o.type){case"VariableDeclarator":t(o.id);break;case"FunctionDeclaration":case"FunctionExpression":case"ArrowFunctionExpression":{t(o.id);const u=o.params;if(Array.isArray(u))for(const p of u)t(p);break}case"ClassDeclaration":case"ClassExpression":t(o.id);break;case"ImportSpecifier":case"ImportDefaultSpecifier":case"ImportNamespaceSpecifier":t(o.local);break;case"CatchClause":t(o.param);break;default:break}}for(const o of Object.keys(i)){if(o==="loc"||o==="comments"||o==="tokens")continue;const u=i[o];if(Array.isArray(u))for(const p of u)l(p)&&e.push(p);else l(u)&&e.push(u)}}}},"visitForBindings");for(const n of a)c(n);return r}f(k,"countBindings");function x(a){const r=new Map;for(const s of a){const t=s.type==="ExportNamedDeclaration"?s.declaration:s;if(!d(t)||t.type!=="VariableDeclaration"||t.kind!=="const")continue;const c=t.declarations;if(Array.isArray(c))for(const n of c){if(!d(n)||n.type!=="VariableDeclarator")continue;const e=n.id,i=n.init;if(!d(e)||e.type!=="Identifier"||!d(i))continue;const o=e.name;typeof o=="string"&&r.set(o,i)}}return r}f(x,"collectTopLevelConstInits");export{w as buildModuleConstResolver,g as readStaticString};

package/dist/src/codemod/edits/objectGraph.d.ts

@@ -0,0 +1,28 @@
+import { type NodeShapeLike, type ObjectExpressionNodeLike, type PropertyNodeLike } from "./modifyResource/literalConversion.js";
+/**
+ * Finds a plain (non-shorthand, non-computed) property by key name.
+ *
+ * `undefined` means "no plain property with that key" — NOT "the key is
+ * absent". A spread, a shorthand, or a computed key can still supply it.
+ * Callers that act on absence must gate on {@link objectAbsenceIsProvable}.
+ */
+export declare function findPropertyByKey(obj: ObjectExpressionNodeLike, key: string): PropertyNodeLike | undefined;
+/**
+ * True when a `findPropertyByKey(obj, key) === undefined` result may safely be
+ * read as "the key is absent from this object".
+ *
+ * False when the object carries a spread (which can supply any key), a
+ * computed property (whose key is not statically known), or a shorthand
+ * property named `key` — each of which makes the key present while
+ * {@link findPropertyByKey} reports nothing. Appending in those cases would
+ * emit a duplicate that silently overrides, or is overridden by, the invisible
+ * one depending on source order.
+ */
+export declare function objectAbsenceIsProvable(obj: ObjectExpressionNodeLike, key: string): boolean;
+/**
+ * Non-recursive depth-first walk over every typed node reachable from `root`.
+ *
+ * Skips `loc`, `comments` and `tokens` so large fixtures do not descend into
+ * parser bookkeeping.
+ */
+export declare function visit(root: NodeShapeLike, visitor: (node: NodeShapeLike) => void): void;

package/dist/src/codemod/edits/objectGraph.js

@@ -0,0 +1 @@
+var f=Object.defineProperty;var s=(t,r)=>f(t,"name",{value:r,configurable:!0});import{isRecord as u}from"../_internal.js";import{readKeyName as c}from"./modifyResource/literalConversion.js";function d(t,r){return t.properties.find(e=>(e.type==="Property"||e.type==="ObjectProperty")&&e.shorthand!==!0&&e.computed!==!0&&c(e.key)===r)}s(d,"findPropertyByKey");function h(t,r){return!t.properties.some(e=>e.type==="SpreadElement"||e.type==="SpreadProperty"?!0:e.type!=="Property"&&e.type!=="ObjectProperty"?!1:e.computed===!0?!0:e.shorthand===!0&&c(e.key)===r)}s(h,"objectAbsenceIsProvable");function l(t,r){const e=[t];for(;e.length>0;){const n=e.pop();if(u(n)){typeof n.type=="string"&&r(n);for(const o of Object.keys(n)){if(o==="loc"||o==="comments"||o==="tokens")continue;const i=n[o];if(Array.isArray(i))for(const y of i)u(y)&&e.push(y);else u(i)&&e.push(i)}}}}s(l,"visit");export{d as findPropertyByKey,h as objectAbsenceIsProvable,l as visit};

package/dist/src/codemod/edits/secretsProvability.d.ts

@@ -0,0 +1,48 @@
+import { type ModuleConstResolver } from "./moduleConstResolver.js";
+import { type ObjectExpressionNodeLike } from "./modifyResource/literalConversion.js";
+/** One element of a `secrets` array, classified for provability. */
+export type SecretsElement = {
+    kind: "literal";
+    name: string;
+    description: string;
+} | {
+    kind: "identifier";
+    name: string;
+    description: string;
+} | {
+    kind: "spread";
+    names: readonly string[];
+    description: string;
+} | {
+    kind: "unresolvable";
+    description: string;
+};
+export type ProvabilityCheck = {
+    ok: true;
+    warnings: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function classifySecretsElement(element: unknown, resolver: ModuleConstResolver): SecretsElement;
+export declare function describeElements(elements: readonly SecretsElement[]): string;
+/**
+ * True when `key` is provably absent from the container object — either
+ * structurally (no spread/shorthand/computed at all) or because every spread
+ * resolves to a same-file const object whose keys are known not to include it.
+ */
+export declare function keyProvablyAbsent(container: ObjectExpressionNodeLike, key: string, resolver: ModuleConstResolver): boolean;
+/**
+ * A spread placed AFTER the `secrets` property overrides it at runtime when
+ * the spread object also carries a `secrets` key — the edit would mutate a
+ * dead literal while reporting success. Refuses unless every later spread is
+ * proven not to redefine `secrets`.
+ */
+export declare function checkShadowingSpread(container: ObjectExpressionNodeLike, secretsPropIndex: number, resolver: ModuleConstResolver): ProvabilityCheck;
+/**
+ * A name present in both `secrets` and `secretsImport` fails `fjall deploy`
+ * at synth (the construct rejects the overlap). Proven collisions refuse;
+ * an unenumerable `secretsImport` degrades to a warning because the
+ * construct's own validation is the authoritative, clearly-worded gate.
+ */
+export declare function checkSecretsImportConflicts(container: ObjectExpressionNodeLike, namesToAdd: readonly string[], resolver: ModuleConstResolver): ProvabilityCheck;

package/dist/src/codemod/edits/secretsProvability.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var o=(t,r)=>m(t,"name",{value:r,configurable:!0});import{readStaticString as g}from"./moduleConstResolver.js";import{isNodeShape as c,readKeyName as h}from"./modifyResource/literalConversion.js";import{findPropertyByKey as d,objectAbsenceIsProvable as b}from"./objectGraph.js";const u="secretsImport";function w(t,r){if(!c(t))return{kind:"unresolvable",description:"an unrecognised element"};if(t.type==="SpreadElement"||t.type==="SpreadProperty"){const e=t.argument;if(c(e)&&e.type==="Identifier"){const n=e.name;if(typeof n=="string"){const s=r.resolveStringArray(n);return s!==void 0?{kind:"spread",names:s,description:`...${n}`}:{kind:"unresolvable",description:`...${n}`}}}return{kind:"unresolvable",description:"...<expression>"}}const i=g(t);if(i!==void 0)return{kind:"literal",name:i,description:JSON.stringify(i)};if(t.type==="Identifier"){const e=t.name;if(typeof e=="string"){const n=r.resolveString(e);return n!==void 0?{kind:"identifier",name:n,description:e}:{kind:"unresolvable",description:e}}}return{kind:"unresolvable",description:"an expression element"}}o(w,"classifySecretsElement");function $(t){const r=t.slice(0,3).map(e=>`\`${e.description}\``),i=t.length>3?", \u2026":"";return r.join(", ")+i}o($,"describeElements");function k(t,r,i){if(d(t,r)!==void 0)return!1;if(b(t,r))return!0;for(const e of t.properties){if(e.type==="SpreadElement"||e.type==="SpreadProperty"){const n=e.argument;if(!c(n))return!1;const s=i.objectKeysOf(n);if(s===void 0||s.includes(r))return!1;continue}if(!(e.type!=="Property"&&e.type!=="ObjectProperty")&&(e.computed===!0||e.shorthand===!0&&h(e.key)===r))return!1}return!0}o(k,"keyProvablyAbsent");function x(t,r,i){for(const e of t.properties.slice(r+1)){if(e.type!=="SpreadElement"&&e.type!=="SpreadProperty")continue;const n=e.argument,s=c(n)&&n.type==="Identifier"?n.name:void 0,a=typeof s=="string"?`...${s}`:"...<expression>";if(!c(n))return{ok:!1,reason:p(a,"cannot be resolved")};const f=i.objectKeysOf(n);if(f===void 0)return{ok:!1,reason:p(a,"does not resolve to a same-file const object")};if(f.includes("secrets"))return{ok:!1,reason:`The container spreads \`${a}\` after \`secrets\`, and it redefines \`secrets\` \u2014 the edit would be overridden at runtime. Edit that object, or move the spread above \`secrets\`.`}}return{ok:!0,warnings:[]}}o(x,"checkShadowingSpread");function p(t,r){return`The container spreads \`${t}\` after \`secrets\`, which ${r}, so the edit cannot be proven to take effect at runtime. Move the spread above \`secrets\` or edit the file by hand.`}o(p,"shadowingReason");function E(t,r,i){if(r.length===0)return{ok:!0,warnings:[]};const e=d(t,u);if(e===void 0)return k(t,u,i)?{ok:!0,warnings:[]}:{ok:!0,warnings:[l(r,"the container may supply `secretsImport` indirectly")]};const n=e.value!==void 0&&c(e.value)?i.objectKeysOf(e.value):void 0;if(n===void 0)return{ok:!0,warnings:[l(r,"`secretsImport` is not statically enumerable here")]};const s=r.filter(a=>n.includes(a));if(s.length>0){const a=s.map(y=>JSON.stringify(y)).join(", "),f=s.length===1?"is":"are";return{ok:!1,reason:`${a} ${f} already wired via \`secretsImport\`; declaring the same name in \`secrets\` fails \`fjall deploy\` at synth. Remove it from \`secretsImport\` first, or use a different name.`}}return{ok:!0,warnings:[]}}o(E,"checkSecretsImportConflicts");function l(t,r){return`Could not check ${t.map(e=>JSON.stringify(e)).join(", ")} against \`secretsImport\` (${r}); a name declared in both is rejected by \`fjall deploy\` at synth.`}o(l,"buildImportWarning");export{E as checkSecretsImportConflicts,x as checkShadowingSpread,w as classifySecretsElement,$ as describeElements,k as keyProvablyAbsent};

package/dist/src/codemod/edits/setContainerSecrets.d.ts

@@ -0,0 +1,55 @@
+import { type Result } from "../../types/Result.js";
+import type { LinesChanged, ParseError } from "../types.js";
+export interface SetContainerSecretsOptions {
+    /** ECS service `name` to target, e.g. "api". */
+    serviceName: string;
+    /** Container within that service. Defaults to the first. */
+    containerIndex?: number;
+    /** Names to declare. Already-declared names are left alone. */
+    add?: readonly string[];
+    /** Names to undeclare. Names not declared are ignored. */
+    remove?: readonly string[];
+    /**
+     * Path the caller's namespace implies. Compared against an explicitly
+     * declared `ssmSecretsPath` to surface a mismatch; never written — an
+     * absent declaration is the construct's own `/<app>/<cluster>/<service>`
+     * derivation and writing it back would duplicate that derivation here.
+     */
+    expectedSsmSecretsPath?: string;
+    filePath?: string;
+}
+export interface SetContainerSecretsSuccess {
+    /** Byte-identical to the input when `skipped` is true. */
+    content: string;
+    linesChanged: LinesChanged;
+    added: string[];
+    removed: string[];
+    skipped: boolean;
+    warnings: string[];
+}
+export interface ServiceNotFoundError {
+    kind: "ServiceNotFoundError";
+    serviceName: string;
+    knownServices: string[];
+}
+export interface ContainerNotFoundError {
+    kind: "ContainerNotFoundError";
+    serviceName: string;
+    containerIndex: number;
+    containerCount: number;
+}
+/**
+ * `reason` is author-written text that may embed identifiers, property keys
+ * and secret NAMES read from the parsed source or CLI input — identifier-class
+ * data, never expression values (see security-standards § "Values, not
+ * identifiers"). It is never error-derived: interpolating a caught error's
+ * message here would silently make every consumer a leak. The CLI boundary
+ * masks defensively regardless.
+ */
+export interface UnsupportedSecretsShapeError {
+    kind: "UnsupportedSecretsShapeError";
+    serviceName: string;
+    reason: string;
+}
+export type SetContainerSecretsError = ParseError | ServiceNotFoundError | ContainerNotFoundError | UnsupportedSecretsShapeError;
+export declare function setContainerSecrets(content: string, options: SetContainerSecretsOptions): Result<SetContainerSecretsSuccess, SetContainerSecretsError>;

package/dist/src/codemod/edits/setContainerSecrets.js

@@ -0,0 +1 @@
+var I=Object.defineProperty;var d=(t,e)=>I(t,"name",{value:e,configurable:!0});import{failure as a,success as m}from"../../types/Result.js";import{DEFAULT_FILE_PATH as _,computeLinesDelta as D,extractProgramBody as M}from"../_internal.js";import{buildObjectProperty as R,detectQuoteStyle as B,parse as K,printFile as q}from"../fileRewriter/index.js";import{makeStringLiteral as H,toAstValue as J}from"./addResource/propertyBuilder.js";import{astToLiteral as W,isNodeShape as v,NON_LITERAL as Y,readKeyName as z}from"./modifyResource/literalConversion.js";import{buildModuleConstResolver as Q}from"./moduleConstResolver.js";import{findPropertyByKey as A,visit as V}from"./objectGraph.js";import{checkSecretsImportConflicts as j,checkShadowingSpread as G,classifySecretsElement as X,describeElements as F,keyProvablyAbsent as Z}from"./secretsProvability.js";const N="ComputeFactory",ee="build",x="secrets";function ve(t,e){const n=e.filePath??_,{serviceName:r}=e,o=e.containerIndex??0,i=e.add??[],u=e.remove??[],c=K(t,n);if(!c.success)return a(c.error);const p=M(c.data);if(p===void 0)return a({kind:"UnsupportedSecretsShapeError",serviceName:r,reason:"recast File is missing program.body"});const l=re(p,r);if(!l.success)return a(l.error);const{service:y}=l.data,h=oe(y,r,o);if(!h.success)return a(h.error);const g=ie(y,r,e.expectedSsmSecretsPath),k=Q(p),b=ae(h.data,r,k,{add:i,remove:u,quoteStyle:B(c.data)});if(!b.success)return a(b.error);const{added:w,removed:C}=b.data,P=[...g,...b.data.warnings];return w.length===0&&C.length===0?m({content:t,linesChanged:{added:0,removed:0},added:[],removed:[],skipped:!0,warnings:P}):m({...te(c.data,t),added:w,removed:C,skipped:!1,warnings:P})}d(ve,"setContainerSecrets");function te(t,e){const n=q(t,e);return{content:n,linesChanged:D(e,n)}}d(te,"printResult");function re(t,e){const n=[],r=[];for(const i of ne(t)){const u=A(i,"services");if(!(u===void 0||!$(u.value)))for(const c of u.value.elements){if(!v(c)||c.type!=="ObjectExpression")continue;const p=c,l=U(p,"name");l!==void 0&&(l===e?r.push(p):n.push(l))}}const[o]=r;return r.length>1?a(S(e,`${String(r.length)} services share the name "${e}" across ComputeFactory.build calls \u2014 the edit cannot be proven to target the right one. Edit the file by hand.`)):o!==void 0?m({service:o}):a({kind:"ServiceNotFoundError",serviceName:e,knownServices:n})}d(re,"locateService");function ne(t){const e=[];for(const n of t)V(n,r=>{if(r.type!=="CallExpression"||!se(r))return;const o=r.arguments;if(!Array.isArray(o))return;const i=o[1];v(i)&&i.type==="ObjectExpression"&&e.push(i)});return e}d(ne,"collectComputeConfigs");function se(t){const e=t.callee;if(!v(e)||e.type!=="MemberExpression"||e.computed===!0)return!1;const n=e.object,r=e.property;return v(n)&&n.type==="Identifier"&&n.name===N&&v(r)&&r.type==="Identifier"&&r.name===ee}d(se,"isComputeFactoryBuild");function oe(t,e,n){const r=A(t,"containers");if(r===void 0||!$(r.value))return a({kind:"UnsupportedSecretsShapeError",serviceName:e,reason:"Service has no `containers` array literal."});const o=r.value.elements,i=o[n];return i===void 0?a({kind:"ContainerNotFoundError",serviceName:e,containerIndex:n,containerCount:o.length}):!v(i)||i.type!=="ObjectExpression"?a({kind:"UnsupportedSecretsShapeError",serviceName:e,reason:`Container ${String(n)} is not an object literal.`}):m(i)}d(oe,"resolveContainer");function ie(t,e,n){if(n===void 0)return[];const r=U(t,"ssmSecretsPath");return r===void 0||r===n?[]:[`Service "${e}" declares ssmSecretsPath "${r}", but the secrets were written under "${n}". The task will read the declared path.`]}d(ie,"collectPathWarnings");function S(t,e){return{kind:"UnsupportedSecretsShapeError",serviceName:t,reason:e}}d(S,"unsupported");function ae(t,e,n,r){const{add:o,remove:i,quoteStyle:u}=r,c=ce(t,x);if(c===-1){if(!Z(t,x,n))return a(S(e,"Container carries a spread, shorthand or computed key that could supply `secrets` invisibly, so an absent property cannot be proven. Declare `secrets` explicitly first."));if(i.length>0&&o.length===0)return m({added:[],removed:[],warnings:[]});const h=O(o),g=j(t,h,n);if(!g.ok)return a(S(e,g.reason));const k=de(t,e,h,u);return k.success?m({...k.data,warnings:g.warnings}):k}const l=t.properties[c]?.value;if(!$(l))return a(S(e,"`secrets` is not an array literal."));const y=G(t,c,n);return y.ok?ue(l,t,e,n,r):a(S(e,y.reason))}d(ae,"applySecrets");function ce(t,e){for(let n=t.properties.length-1;n>=0;n--){const r=t.properties[n];if(r!==void 0&&(r.type==="Property"||r.type==="ObjectProperty")&&r.shorthand!==!0&&r.computed!==!0&&z(r.key)===e)return n}return-1}d(ce,"findLastPlainPropertyIndex");function de(t,e,n,r){const o=O(n);if(o.length===0)return m({added:[],removed:[]});const i=J(o,r);if(i===void 0)return a({kind:"UnsupportedSecretsShapeError",serviceName:e,reason:"Unable to build a `secrets` array literal."});const u=R(x,i,r);return t.properties[t.properties.length-1]?.extra?.trailingComma===!0&&(u.extra={...u.extra??{},trailingComma:!0}),t.properties.push(u),m({added:o,removed:[]})}d(de,"createSecretsArray");function ue(t,e,n,r,o){const{add:i,remove:u,quoteStyle:c}=o,p=t.elements.map(s=>X(s,r)),l=p.filter(s=>s.kind==="unresolvable"),y=new Set(u);if(y.size>0){if(l.length>0)return a(S(n,`\`secrets\` contains ${F(l)}, which cannot be resolved to string literals in this file, so a removed name cannot be proven gone. Edit the array by hand.`));for(const s of p){if(s.kind!=="spread")continue;const E=s.names.filter(f=>y.has(f));if(E.length>0){const f=E.map(T=>JSON.stringify(T)).join(", "),L=E.length===1?"is":"are";return a(S(n,`${f} ${L} supplied by \`${s.description}\`, so this edit cannot undeclare it \u2014 the shared array may feed other services. Edit \`${s.description.slice(3)}\` by hand.`))}}}const h=[],g=[];t.elements=t.elements.filter((s,E)=>{const f=p[E];return f!==void 0&&(f.kind==="literal"||f.kind==="identifier")&&y.has(f.name)?(h.push(f.name),!1):(f!==void 0&&g.push(f),!0)});const k=new Set(g.flatMap(s=>s.kind==="unresolvable"?[]:s.kind==="spread"?[...s.names]:[s.name])),b=O(i).filter(s=>!k.has(s));if(b.length===0)return m({added:[],removed:h,warnings:[]});const w=g.filter(s=>s.kind==="unresolvable");if(w.length>0){const s=b.map(E=>JSON.stringify(E)).join(", ");return a(S(n,`\`secrets\` contains ${F(w)}, which cannot be resolved in this file, so ${s} cannot be proven absent \u2014 a duplicate name breaks \`fjall deploy\` at synth. Add it by hand.`))}const C=j(e,b,r);if(!C.ok)return a(S(n,C.reason));const P=[];for(const s of b)t.elements.push(H(s,c)),P.push(s);return m({added:P,removed:h,warnings:C.warnings})}d(ue,"mutateSecretsArray");function U(t,e){const n=A(t,e);if(n===void 0||!v(n.value))return;const r=W(n.value);return r===Y||typeof r!="string"?void 0:r}d(U,"readStringProperty");function $(t){return v(t)&&t.type==="ArrayExpression"&&Array.isArray(t.elements)}d($,"isArrayExpression");function O(t){return[...new Set(t)]}d(O,"dedupe");export{ve as setContainerSecrets};

package/dist/src/codemod/index.d.ts

@@ -2,6 +2,7 @@ export { addResource, type AddResourceCallContext, type AddResourceError, type A
 export { removeResource, type RemoveResourceError, type RemoveResourceSuccess, } from "./edits/removeResource.js";
 export { modifyResource, type ModifyResourceCallContext, type ModifyResourceError, type ModifyResourceSuccess, } from "./edits/modifyResource.js";
 export { appendAccountToStage, type AppendAccountToStageError, type AppendAccountToStageOptions, type AppendAccountToStageSuccess, } from "./edits/appendAccountToStage.js";
+export { setContainerSecrets, type SetContainerSecretsError, type SetContainerSecretsOptions, type SetContainerSecretsSuccess, } from "./edits/setContainerSecrets.js";
 export { addVpcPeer, modifyVpcPeer, removeVpcPeer, type VpcPeerAddOptions, type VpcPeerModifyOptions, type VpcPeerOrchestratorSuccess, type VpcPeerRemoveOptions, } from "./edits/vpcPeer.js";
 export { addVpcPeerAccepter, modifyVpcPeerAccepter, removeVpcPeerAccepter, type VpcPeerAccepterAddOptions, type VpcPeerAccepterModifyOptions, type VpcPeerAccepterOrchestratorSuccess, type VpcPeerAccepterRemoveOptions, } from "./edits/vpcPeerAccepter.js";
 export { addCrossPlanConnection, modifyCrossPlanConnection, removeCrossPlanConnection, type CrossPlanConnectionAddOptions, type CrossPlanConnectionModifyOptions, type CrossPlanConnectionOrchestratorSuccess, type CrossPlanConnectionRemoveOptions, } from "./edits/crossPlanConnection.js";

package/dist/src/codemod/index.js

@@ -1 +1 @@
-import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as s}from"./edits/appendAccountToStage.js";import{addVpcPeer as d,modifyVpcPeer as E,removeVpcPeer as i}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as f,modifyVpcPeerAccepter as u,removeVpcPeerAccepter as P}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as R,modifyCrossPlanConnection as T,removeCrossPlanConnection as S}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as A}from"./edits/driftPolicy.js";import{listResources as V}from"./listResources.js";import{resolveConstructByLiteralProperty as y}from"./semanticIndex/index.js";import{parse as D}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as N,VpcPeerAccepterResourcePlanSchema as h,VpcPeerResourcePlanSchema as F}from"../schemas/index.js";import{detectDrift as I,mergeProperties as M,snapshotProperties as O}from"./drift/index.js";import{computeLinesDelta as k}from"./_internal.js";import{ResourceNameSchema as U,StatementTypeSchema as K}from"./types.js";import{REGISTERED_STATEMENT_TYPES as j,STATEMENT_REGISTRY as q}from"./registry.js";import{evaluateEmitGuard as z,UNRESOLVED as H}from"./emitGuard.js";import{CODEMOD_ERROR_KINDS as Q}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as X,buildFiredEvent as Z,buildGateFailedEvent as $,buildGatePassedEvent as ee,buildRejectedEvent as re,buildSucceededEvent as oe,buildTimeoutEvent as te,estimateCostUsd as ce,FALLBACK_EVENTS as pe,GATE_EVENTS as me,PARSE_GATE as ae,RUNTIME_GATE as se,runFallback as ne,shouldTryFallback as de}from"./llmFallback/index.js";export{Q as CODEMOD_ERROR_KINDS,N as CrossPlanConnectionResourcePlanSchema,pe as FALLBACK_EVENTS,me as GATE_EVENTS,ae as PARSE_GATE,j as REGISTERED_STATEMENT_TYPES,se as RUNTIME_GATE,U as ResourceNameSchema,q as STATEMENT_REGISTRY,K as StatementTypeSchema,H as UNRESOLVED,h as VpcPeerAccepterResourcePlanSchema,F as VpcPeerResourcePlanSchema,R as addCrossPlanConnection,o as addResource,d as addVpcPeer,f as addVpcPeerAccepter,s as appendAccountToStage,X as buildEgressBlockedEvent,Z as buildFiredEvent,$ as buildGateFailedEvent,ee as buildGatePassedEvent,re as buildRejectedEvent,oe as buildSucceededEvent,te as buildTimeoutEvent,k as computeLinesDelta,I as detectDrift,ce as estimateCostUsd,z as evaluateEmitGuard,V as listResources,M as mergeProperties,T as modifyCrossPlanConnection,m as modifyResource,E as modifyVpcPeer,u as modifyVpcPeerAccepter,D as parse,S as removeCrossPlanConnection,c as removeResource,i as removeVpcPeer,P as removeVpcPeerAccepter,y as resolveConstructByLiteralProperty,A as resolveDriftPolicy,ne as runFallback,de as shouldTryFallback,O as snapshotProperties};
+import{addResource as o}from"./edits/addResource.js";import{removeResource as c}from"./edits/removeResource.js";import{modifyResource as m}from"./edits/modifyResource.js";import{appendAccountToStage as s}from"./edits/appendAccountToStage.js";import{setContainerSecrets as d}from"./edits/setContainerSecrets.js";import{addVpcPeer as i,modifyVpcPeer as l,removeVpcPeer as f}from"./edits/vpcPeer.js";import{addVpcPeerAccepter as P,modifyVpcPeerAccepter as x,removeVpcPeerAccepter as R}from"./edits/vpcPeerAccepter.js";import{addCrossPlanConnection as T,modifyCrossPlanConnection as v,removeCrossPlanConnection as A}from"./edits/crossPlanConnection.js";import{resolveDriftPolicy as V}from"./edits/driftPolicy.js";import{listResources as y}from"./listResources.js";import{resolveConstructByLiteralProperty as D}from"./semanticIndex/index.js";import{parse as N}from"./fileRewriter/parse.js";import{CrossPlanConnectionResourcePlanSchema as F,VpcPeerAccepterResourcePlanSchema as L,VpcPeerResourcePlanSchema as I}from"../schemas/index.js";import{detectDrift as O,mergeProperties as g,snapshotProperties as k}from"./drift/index.js";import{computeLinesDelta as U}from"./_internal.js";import{ResourceNameSchema as Y,StatementTypeSchema as j}from"./types.js";import{REGISTERED_STATEMENT_TYPES as w,STATEMENT_REGISTRY as z}from"./registry.js";import{evaluateEmitGuard as J,UNRESOLVED as Q}from"./emitGuard.js";import{CODEMOD_ERROR_KINDS as X}from"./telemetry/errorKinds.js";import{buildEgressBlockedEvent as $,buildFiredEvent as ee,buildGateFailedEvent as re,buildGatePassedEvent as oe,buildRejectedEvent as te,buildSucceededEvent as ce,buildTimeoutEvent as pe,estimateCostUsd as me,FALLBACK_EVENTS as ae,GATE_EVENTS as se,PARSE_GATE as ne,RUNTIME_GATE as de,runFallback as Ee,shouldTryFallback as ie}from"./llmFallback/index.js";export{X as CODEMOD_ERROR_KINDS,F as CrossPlanConnectionResourcePlanSchema,ae as FALLBACK_EVENTS,se as GATE_EVENTS,ne as PARSE_GATE,w as REGISTERED_STATEMENT_TYPES,de as RUNTIME_GATE,Y as ResourceNameSchema,z as STATEMENT_REGISTRY,j as StatementTypeSchema,Q as UNRESOLVED,L as VpcPeerAccepterResourcePlanSchema,I as VpcPeerResourcePlanSchema,T as addCrossPlanConnection,o as addResource,i as addVpcPeer,P as addVpcPeerAccepter,s as appendAccountToStage,$ as buildEgressBlockedEvent,ee as buildFiredEvent,re as buildGateFailedEvent,oe as buildGatePassedEvent,te as buildRejectedEvent,ce as buildSucceededEvent,pe as buildTimeoutEvent,U as computeLinesDelta,O as detectDrift,me as estimateCostUsd,J as evaluateEmitGuard,y as listResources,g as mergeProperties,v as modifyCrossPlanConnection,m as modifyResource,l as modifyVpcPeer,x as modifyVpcPeerAccepter,N as parse,A as removeCrossPlanConnection,c as removeResource,f as removeVpcPeer,R as removeVpcPeerAccepter,D as resolveConstructByLiteralProperty,V as resolveDriftPolicy,Ee as runFallback,d as setContainerSecrets,ie as shouldTryFallback,k as snapshotProperties};

package/dist/src/dns/bindParser.js

@@ -1,2 +1,2 @@
-var m=Object.defineProperty;var c=(e,n)=>m(e,"name",{value:n,configurable:!0});import{success as I,failure as T}from"../types/Result.js";import{DnsRecordTypeSchema as A,BIND_DIRECTIVES as d,ALIAS_PREFIX as E}from"./types.js";const v=new Set(A.options);function L(e){return v.has(e.toUpperCase())}c(L,"isRecordType");function C(e){return e.endsWith(".")?e.slice(0,-1):e}c(C,"stripTrailingDot");function R(e){let n=!1;for(let t=0;t<e.length;t++)if(e[t]==='"')n=!n;else if(e[t]===";"&&!n)return e.slice(0,t).trimEnd();return e}c(R,"stripInlineComment");function D(e,n){const t=e.slice(n).join(" "),s=[];let i="",r=!1;for(const o of t)o==='"'?(r&&(s.push(i),i=""),r=!r):r&&(i+=o);return s.join(" ")}c(D,"parseTxtValue");function $(e){const n=/;\s*auto\s*$/.test(e),s=e.replace(/;\s*auto\s*$/,"").trim().match(/^\$FJALL-DELEGATE\s+(\S+)\s+TO\s+(\S+)$/i);if(s)return{subdomain:s[1],targetAccount:s[2],auto:n}}c($,"parseDelegateDirective");function S(e){if(e.length<2)return;const n=e[1],t=e.slice(2);return{domainName:n,subjectAlternativeNames:t}}c(S,"parseCertDirective");function j(e){const n=[];let t="",s=!1;for(const i of e)i==='"'?(s=!s,t+=i):/\s/.test(i)&&!s?t.length>0&&(n.push(t),t=""):t+=i;return t.length>0&&n.push(t),n}c(j,"tokenise");function w(e){if(e.length<2)return;let n=0;const t=e[n++];let s,i;for(;n<e.length&&i===void 0;){const o=e[n].toUpperCase();if(o==="IN")n++;else if(L(o))i=o,n++;else if(/^\d+$/.test(e[n]))s=parseInt(e[n],10),n++;else return}if(!i)return;const r=e.slice(n);switch(i){case"MX":{if(r.length<2)return;const o=parseInt(r[0],10),f=r.slice(1).join(" ");return{name:t,type:i,ttl:s,value:f,priority:o}}case"SRV":{if(r.length<4)return;const o=parseInt(r[0],10),f=parseInt(r[1],10),l=parseInt(r[2],10),p=r[3];return{name:t,type:i,ttl:s,value:p,priority:o,weight:f,port:l}}case"TXT":{const o=D(e,n);return{name:t,type:i,ttl:s,value:o}}case"CAA":{const o=r.join(" ");return{name:t,type:i,ttl:s,value:o}}case"A":{if(r.length===0)return;if(r[0].toUpperCase()==="ALIAS"){if(r.length<2)return;const f=r.slice(1).join(" ");return{name:t,type:i,ttl:s,value:`${E}${f}`}}return{name:t,type:i,ttl:s,value:r[0]}}default:return r.length===0?void 0:{name:t,type:i,ttl:s,value:r[0]}}}c(w,"parseRecord");function U(e){const n=e.split(`
-`);let t,s=300;const i=[],r=[],o=[];for(const f of n){const l=f.trim();if(l===""||l.startsWith(";"))continue;if(l.toUpperCase().startsWith(d.FJALL_DELEGATE)){const a=$(l);a&&r.push(a);continue}const p=R(l);if(p==="")continue;const u=j(p);if(u.length===0)continue;const h=u[0].toUpperCase();if(h===d.ORIGIN){if(u.length<2)continue;t=C(u[1]);continue}if(h===d.TTL){if(u.length<2)continue;s=parseInt(u[1],10);continue}if(h===d.FJALL_CERT){const a=S(u);a&&o.push(a);continue}const g=w(u);g&&i.push(g)}return t?I({origin:t,ttl:s,records:i,delegations:r,certificates:o}):T(new Error("Missing $ORIGIN directive"))}c(U,"parseZoneFile");function _(e,n){if(!e.startsWith("fjall:"))return;const t=e.split(":");if(t.length<3)return;const s=t[1],i=t[2],r=`${s}:${i}`;return n.get(r)??n.get(e)}c(_,"resolveAlias");export{U as parseZoneFile,_ as resolveAlias};
+var m=Object.defineProperty;var c=(e,n)=>m(e,"name",{value:n,configurable:!0});import{success as A,failure as I}from"../types/Result.js";import{DnsRecordTypeSchema as T,BIND_DIRECTIVES as d,ALIAS_PREFIX as E}from"./types.js";const v=new Set(T.options);function L(e){return v.has(e.toUpperCase())}c(L,"isRecordType");function C(e){return e.endsWith(".")?e.slice(0,-1):e}c(C,"stripTrailingDot");function R(e){let n=!1;for(let t=0;t<e.length;t++)if(e[t]==='"')n=!n;else if(e[t]===";"&&!n)return e.slice(0,t).trimEnd();return e}c(R,"stripInlineComment");function D(e,n){const t=e.slice(n).join(" "),s=[];let i="",r=!1;for(const o of t)o==='"'?(r&&(s.push(i),i=""),r=!r):r&&(i+=o);return s.join(" ")}c(D,"parseTxtValue");function $(e){const n=/;\s*auto\s*$/.test(e),s=e.replace(/;\s*auto\s*$/,"").trim().match(/^\$FJALL-DELEGATE\s+(\S+)\s+TO\s+(\S+)$/i);if(s)return{subdomain:s[1],targetAccount:s[2],auto:n}}c($,"parseDelegateDirective");function S(e){if(e.length<2)return;const n=e[1],t=e.slice(2);return{domainName:n,subjectAlternativeNames:t}}c(S,"parseCertDirective");function j(e){const n=[];let t="",s=!1;for(const i of e)i==='"'?(s=!s,t+=i):/\s/.test(i)&&!s?t.length>0&&(n.push(t),t=""):t+=i;return t.length>0&&n.push(t),n}c(j,"tokenise");function w(e){if(e.length<2)return;let n=0;const t=e[n++];let s,i;for(;n<e.length&&i===void 0;){const o=e[n].toUpperCase();if(o==="IN")n++;else if(L(o))i=o,n++;else if(/^\d+$/.test(e[n]))s=parseInt(e[n],10),n++;else return}if(!i)return;const r=e.slice(n);switch(i){case"MX":{if(r.length<2)return;const o=parseInt(r[0],10),f=r.slice(1).join(" ");return{name:t,type:i,ttl:s,value:f,priority:o}}case"SRV":{if(r.length<4)return;const o=parseInt(r[0],10),f=parseInt(r[1],10),l=parseInt(r[2],10),p=r[3];return{name:t,type:i,ttl:s,value:p,priority:o,weight:f,port:l}}case"TXT":{const o=D(e,n);return{name:t,type:i,ttl:s,value:o}}case"CAA":{const o=r.join(" ");return{name:t,type:i,ttl:s,value:o}}case"A":case"AAAA":{if(r.length===0)return;if(r[0].toUpperCase()==="ALIAS"){if(r.length<2)return;const f=r.slice(1).join(" ");return{name:t,type:i,ttl:s,value:`${E}${f}`}}return{name:t,type:i,ttl:s,value:r[0]}}default:return r.length===0?void 0:{name:t,type:i,ttl:s,value:r[0]}}}c(w,"parseRecord");function U(e){const n=e.split(`
+`);let t,s=300;const i=[],r=[],o=[];for(const f of n){const l=f.trim();if(l===""||l.startsWith(";"))continue;if(l.toUpperCase().startsWith(d.FJALL_DELEGATE)){const a=$(l);a&&r.push(a);continue}const p=R(l);if(p==="")continue;const u=j(p);if(u.length===0)continue;const h=u[0].toUpperCase();if(h===d.ORIGIN){if(u.length<2)continue;t=C(u[1]);continue}if(h===d.TTL){if(u.length<2)continue;s=parseInt(u[1],10);continue}if(h===d.FJALL_CERT){const a=S(u);a&&o.push(a);continue}const g=w(u);g&&i.push(g)}return t?A({origin:t,ttl:s,records:i,delegations:r,certificates:o}):I(new Error("Missing $ORIGIN directive"))}c(U,"parseZoneFile");function _(e,n){if(!e.startsWith("fjall:"))return;const t=e.split(":");if(t.length<3)return;const s=t[1],i=t[2],r=`${s}:${i}`;return n.get(r)??n.get(e)}c(_,"resolveAlias");export{U as parseZoneFile,_ as resolveAlias};

package/dist/src/dns/bindWriter.js

@@ -1,3 +1,3 @@
-var u=Object.defineProperty;var $=(t,n)=>u(t,"name",{value:n,configurable:!0});import{BIND_DIRECTIVES as i,ALIAS_PREFIX as l}from"./types.js";function f(t,n){return t.length>=n?t:t+" ".repeat(n-t.length)}$(f,"padRight");function p(t,n){const s=f(t.name,24),e=t.ttl!==void 0&&t.ttl!==n?`${t.ttl} `:"";switch(t.type){case"MX":return`${s} ${e}IN MX ${t.priority??10} ${t.value}`;case"SRV":return`${s} ${e}IN SRV ${t.priority??0} ${t.weight??0} ${t.port??0} ${t.value}`;case"TXT":return`${s} ${e}IN TXT "${t.value}"`;case"CAA":return`${s} ${e}IN CAA ${t.value}`;default:return t.type==="A"&&t.value.startsWith(l)?`${s} ${e}IN A ${t.value}`:`${s} ${e}IN ${t.type} ${t.value}`}}$(p,"formatRecord");function g(t){const n=[];if(n.push("; zone.bind \u2014 managed by fjall"),n.push(`${i.ORIGIN} ${t.origin}.`),n.push(`${i.TTL} ${t.ttl}`),n.push(""),t.certificates.length>0){for(const s of t.certificates){const a=[s.domainName,...s.subjectAlternativeNames];n.push(`${i.FJALL_CERT} ${a.join(" ")}`)}n.push("")}if(t.delegations.length>0){for(const s of t.delegations){const a=s.auto?" ; auto":"";n.push(`${i.FJALL_DELEGATE} ${s.subdomain} TO ${s.targetAccount}${a}`)}n.push("")}for(const s of t.records)n.push(p(s,t.ttl));return n.join(`
+var u=Object.defineProperty;var i=(t,n)=>u(t,"name",{value:n,configurable:!0});import{BIND_DIRECTIVES as $}from"./types.js";function l(t,n){return t.length>=n?t:t+" ".repeat(n-t.length)}i(l,"padRight");function o(t,n){const s=l(t.name,24),e=t.ttl!==void 0&&t.ttl!==n?`${t.ttl} `:"";switch(t.type){case"MX":return`${s} ${e}IN MX ${t.priority??10} ${t.value}`;case"SRV":return`${s} ${e}IN SRV ${t.priority??0} ${t.weight??0} ${t.port??0} ${t.value}`;case"TXT":return`${s} ${e}IN TXT "${t.value}"`;case"CAA":return`${s} ${e}IN CAA ${t.value}`;default:return`${s} ${e}IN ${t.type} ${t.value}`}}i(o,"formatRecord");function h(t){const n=[];if(n.push("; zone.bind \u2014 managed by fjall"),n.push(`${$.ORIGIN} ${t.origin}.`),n.push(`${$.TTL} ${t.ttl}`),n.push(""),t.certificates.length>0){for(const s of t.certificates){const a=[s.domainName,...s.subjectAlternativeNames];n.push(`${$.FJALL_CERT} ${a.join(" ")}`)}n.push("")}if(t.delegations.length>0){for(const s of t.delegations){const a=s.auto?" ; auto":"";n.push(`${$.FJALL_DELEGATE} ${s.subdomain} TO ${s.targetAccount}${a}`)}n.push("")}for(const s of t.records)n.push(o(s,t.ttl));return n.join(`
 `)+`
-`}$(g,"generateZoneFile");export{g as generateZoneFile};
+`}i(h,"generateZoneFile");export{h as generateZoneFile};

package/dist/src/dns/domainRecords.d.ts

@@ -2,6 +2,7 @@ import { z } from "zod";
 export declare const TypedFjallTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"ecs">;
     appName: z.ZodString;
+    computeName: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"cdn">;
     appName: z.ZodString;
@@ -65,6 +66,7 @@ export declare const ParsedAliasRecordSchema: z.ZodObject<{
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"ecs">;
         appName: z.ZodString;
+        computeName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"cdn">;
         appName: z.ZodString;
@@ -102,6 +104,7 @@ export declare const ParsedDnsRecordSchema: z.ZodDiscriminatedUnion<[z.ZodObject
     target: z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"ecs">;
         appName: z.ZodString;
+        computeName: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"cdn">;
         appName: z.ZodString;
@@ -160,6 +163,7 @@ export declare const ParsedDomainRecordsSchema: z.ZodObject<{
         target: z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"ecs">;
             appName: z.ZodString;
+            computeName: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"cdn">;
             appName: z.ZodString;

package/dist/src/dns/domainRecords.js

@@ -1 +1 @@
-import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),o=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),i=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[o,i]),d=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),c=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(s),certificates:e.array(d),delegations:e.array(c)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,i as ParsedAliasRecordSchema,d as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,o as ParsedStandardRecordSchema,c as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};
+import{z as e}from"zod";const r=e.discriminatedUnion("kind",[e.object({kind:e.literal("ecs"),appName:e.string(),computeName:e.string().min(1).optional()}).strict(),e.object({kind:e.literal("cdn"),appName:e.string()}).strict(),e.object({kind:e.literal("bucket"),bucketName:e.string()}).strict(),e.object({kind:e.literal("custom"),dnsName:e.string(),hostedZoneId:e.string()}).strict()]),m=r.options.map(t=>t.shape.kind.value),a=e.enum(["A","AAAA"]),n=e.enum(["route53","external-delegated","external-records"]),g=e.enum(["zone","full"]),o=e.object({kind:e.literal("standard"),type:e.enum(["A","AAAA","CNAME","MX","TXT","NS","SRV","CAA"]),name:e.string(),value:e.union([e.string(),e.array(e.string())]),ttl:e.number().int().positive().optional()}).strict(),i=e.object({kind:e.literal("alias"),type:a,name:e.string(),target:r}).strict(),s=e.discriminatedUnion("kind",[o,i]),d=e.object({domainName:e.string(),subjectAlternativeNames:e.array(e.string()).optional(),transparencyLogging:e.boolean().optional(),cloudFront:e.boolean().optional()}).strict(),c=e.object({subdomain:e.string(),toAccount:e.string(),auto:e.boolean().optional()}).strict(),p=e.object({zoneName:e.string(),registrar:n,hostedZoneId:e.string().optional(),delegatedSubdomain:e.string().optional(),adoptedNameServers:e.array(e.string().min(1)).min(1).optional(),records:e.array(s),certificates:e.array(d),delegations:e.array(c)}).strict().refine(t=>t.registrar!=="external-delegated"||t.delegatedSubdomain!==void 0,{message:"external-delegated requires delegatedSubdomain"}).refine(t=>t.registrar!=="external-records"||t.delegations.length===0,{message:"external-records forbids delegations"}).refine(t=>t.registrar==="external-delegated"||t.adoptedNameServers===void 0,{message:"adoptedNameServers requires registrar external-delegated"}).refine(t=>t.registrar!=="external-delegated"||t.hostedZoneId===void 0==(t.adoptedNameServers===void 0),{message:"external-delegated adoption requires hostedZoneId and adoptedNameServers together (both-or-neither)"});export{a as AliasRecordTypeSchema,g as DomainDeployPhaseSchema,n as DomainRegistrarSchema,i as ParsedAliasRecordSchema,d as ParsedCertificateSchema,s as ParsedDnsRecordSchema,p as ParsedDomainRecordsSchema,o as ParsedStandardRecordSchema,c as ParsedSubdomainDelegationSchema,m as TYPED_FJALL_TARGET_KINDS,r as TypedFjallTargetSchema};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "7.3.0";
+export declare const GENERATOR_VERSION = "8.0.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="7.3.0";export{E as GENERATOR_VERSION};
+const E="8.0.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "7.3.0",
+  "version": "8.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -53,7 +53,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^7.3.0",
+    "@fjall/util": "^8.0.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",