@fjall/util 2.30.0 → 2.31.1

package/dist/.minified

@@ -1 +1 @@
-84 files minified at 2026-07-15T07:08:25.279Z
+84 files minified at 2026-07-16T20:42:02.563Z

package/dist/infra/deployArtefacts.d.ts

@@ -42,6 +42,14 @@ export type ImageTag = z.infer<typeof ImageTagSchema>;
  * neither may invent placeholder values. `previousTaskDefinitionArn` exists
  * only where an explicit RegisterTaskDefinition rollout captured it.
  * `ecrRepositoryArn` is absent for non-ECR registries.
+ *
+ * `functionArn`/`publishedVersion` are the Lambda analogue of
+ * `taskDefinitionArn`: present whenever a fresh version was published for a
+ * container-image Lambda — on a full deploy via the best-effort post-deploy
+ * `lambda:PublishVersion` step (a publish failure degrades the artefact, it
+ * never fails an already-succeeded deploy), and on code-only rollouts AND
+ * rollbacks via `UpdateFunctionCode`'s `Publish: true`, which publishes
+ * alongside the update itself.
  */
 export declare const ServiceArtefactSchema: z.ZodObject<{
     serviceName: z.ZodString;
@@ -51,6 +59,8 @@ export declare const ServiceArtefactSchema: z.ZodObject<{
     ecrRepositoryArn: z.ZodOptional<z.ZodString>;
     taskDefinitionArn: z.ZodOptional<z.ZodString>;
     previousTaskDefinitionArn: z.ZodOptional<z.ZodString>;
+    functionArn: z.ZodOptional<z.ZodString>;
+    publishedVersion: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ServiceArtefact = z.infer<typeof ServiceArtefactSchema>;
 export declare const ServiceArtefactsSchema: z.ZodArray<z.ZodObject<{
@@ -61,6 +71,8 @@ export declare const ServiceArtefactsSchema: z.ZodArray<z.ZodObject<{
     ecrRepositoryArn: z.ZodOptional<z.ZodString>;
     taskDefinitionArn: z.ZodOptional<z.ZodString>;
     previousTaskDefinitionArn: z.ZodOptional<z.ZodString>;
+    functionArn: z.ZodOptional<z.ZodString>;
+    publishedVersion: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>>;
 export type ServiceArtefacts = z.infer<typeof ServiceArtefactsSchema>;
 /**

package/dist/infra/deployArtefacts.js

@@ -1 +1 @@
-import{z as t}from"zod";const r=["full","code-only","rollback","restart"],c=t.enum(r),n=/^[a-zA-Z0-9._-]+$/,o=t.string().min(1).max(128).regex(n),a=t.object({serviceName:t.string().min(1),imageTag:o,imageDigest:t.string().min(1).optional(),imageUri:t.string().min(1),ecrRepositoryArn:t.string().min(1).optional(),taskDefinitionArn:t.string().min(1).optional(),previousTaskDefinitionArn:t.string().min(1).optional()}).strict(),m=t.array(a),g=["TaskDefinition","PreviousTaskDefinition","ImageTag","ImageUri","EcrRepositoryArn","ImageDigest"];function p(e,i){return`${e}${i}`}export{g as ARTEFACT_OUTPUT_FIELDS,r as DEPLOY_MODES,c as DeployModeSchema,n as IMAGE_TAG_PATTERN,o as ImageTagSchema,a as ServiceArtefactSchema,m as ServiceArtefactsSchema,p as artefactOutputKey};
+import{z as i}from"zod";const n=["full","code-only","rollback","restart"],c=i.enum(n),o=/^[a-zA-Z0-9._-]+$/,r=i.string().min(1).max(128).regex(o),a=i.object({serviceName:i.string().min(1),imageTag:r,imageDigest:i.string().min(1).optional(),imageUri:i.string().min(1),ecrRepositoryArn:i.string().min(1).optional(),taskDefinitionArn:i.string().min(1).optional(),previousTaskDefinitionArn:i.string().min(1).optional(),functionArn:i.string().min(1).optional(),publishedVersion:i.string().min(1).optional()}).strict(),m=i.array(a),g=["TaskDefinition","PreviousTaskDefinition","ImageTag","ImageUri","EcrRepositoryArn","ImageDigest"];function p(t,e){return`${t}${e}`}export{g as ARTEFACT_OUTPUT_FIELDS,n as DEPLOY_MODES,c as DeployModeSchema,o as IMAGE_TAG_PATTERN,r as ImageTagSchema,a as ServiceArtefactSchema,m as ServiceArtefactsSchema,p as artefactOutputKey};

package/dist/manifest/index.d.ts

@@ -7,4 +7,4 @@
  * the barrel — the package.json `exports` map exposes both subpaths.
  */
 export { DockerBuildSchema, DockerBuildArgValueSchema, DockerBuildSecretRefSchema, DockerBuildPartialSchema, mergeDockerBuild, ManifestServiceSchema, ManifestPatternSchema, ManifestEcrSchema, ManifestLambdaSchema, ManifestStackHashSchema, ResourceMapEntrySchema, FjallManifestSchema, FJALL_MANIFEST_FILENAME, MANIFEST_SCHEMA_VERSION, BUILDKIT_SECRET_ID_PATTERN, type DockerBuild, type DockerBuildArgValue, type DockerBuildSecretRef, type DockerBuildPartial, type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ResourceMapEntry, type FjallManifest } from "./schemas.js";
-export { getManifestFilePath, readManifestFile, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, type ManifestDockerService } from "./io.js";
+export { getManifestFilePath, readManifestFile, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, type ManifestDockerService, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations } from "./io.js";

package/dist/manifest/index.js

@@ -1 +1 @@
-import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as c,DockerBuildPartialSchema as i,mergeDockerBuild as S,ManifestServiceSchema as m,ManifestPatternSchema as M,ManifestEcrSchema as s,ManifestLambdaSchema as f,ManifestStackHashSchema as n,ResourceMapEntrySchema as h,FjallManifestSchema as o,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as E,BUILDKIT_SECRET_ID_PATTERN as F}from"./schemas.js";import{getManifestFilePath as u,readManifestFile as D,writeManifestFile as k,createEmptyManifest as A,readConstructMap as I,parseDockerServicesFromManifest as _}from"./io.js";export{F as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,i as DockerBuildPartialSchema,r as DockerBuildSchema,c as DockerBuildSecretRefSchema,l as FJALL_MANIFEST_FILENAME,o as FjallManifestSchema,E as MANIFEST_SCHEMA_VERSION,s as ManifestEcrSchema,f as ManifestLambdaSchema,M as ManifestPatternSchema,m as ManifestServiceSchema,n as ManifestStackHashSchema,h as ResourceMapEntrySchema,A as createEmptyManifest,u as getManifestFilePath,S as mergeDockerBuild,_ as parseDockerServicesFromManifest,I as readConstructMap,D as readManifestFile,k as writeManifestFile};
+import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as c,DockerBuildPartialSchema as i,mergeDockerBuild as s,ManifestServiceSchema as m,ManifestPatternSchema as S,ManifestEcrSchema as o,ManifestLambdaSchema as M,ManifestStackHashSchema as n,ResourceMapEntrySchema as f,FjallManifestSchema as h,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as E,BUILDKIT_SECRET_ID_PATTERN as D}from"./schemas.js";import{getManifestFilePath as d,readManifestFile as k,writeManifestFile as p,createEmptyManifest as u,readConstructMap as A,parseDockerServicesFromManifest as I,parseLambdaDockerServicesFromManifest as L,parseLambdaDockerEntriesFromManifest as _,parseDockerDeclarationsFromManifest as B}from"./io.js";export{D as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,i as DockerBuildPartialSchema,r as DockerBuildSchema,c as DockerBuildSecretRefSchema,l as FJALL_MANIFEST_FILENAME,h as FjallManifestSchema,E as MANIFEST_SCHEMA_VERSION,o as ManifestEcrSchema,M as ManifestLambdaSchema,S as ManifestPatternSchema,m as ManifestServiceSchema,n as ManifestStackHashSchema,f as ResourceMapEntrySchema,u as createEmptyManifest,d as getManifestFilePath,s as mergeDockerBuild,B as parseDockerDeclarationsFromManifest,I as parseDockerServicesFromManifest,_ as parseLambdaDockerEntriesFromManifest,L as parseLambdaDockerServicesFromManifest,A as readConstructMap,k as readManifestFile,p as writeManifestFile};

package/dist/manifest/io.d.ts

@@ -58,3 +58,80 @@ export interface ManifestDockerService {
  * the deploy phase.
  */
 export declare function parseDockerServicesFromManifest(cdkOutPath: string): ManifestDockerService[];
+/**
+ * Extract Lambda container-image entries with a Docker build configuration
+ * from the Fjall manifest, projected into the same `{name, docker}` shape
+ * `parseDockerServicesFromManifest` returns for ECS services — this lets both
+ * lists feed the same downstream build/grouping/tagging pipeline unchanged.
+ *
+ * The projected `name` is the Lambda's `imageKey` (falling back to its own
+ * manifest `name` when absent): several Lambda functions may deliberately
+ * share one built image, so the build/tag identity is keyed by the shared
+ * image, not by each function's own name. Entries sharing one `imageKey` are
+ * deduped to a single build; a divergent `docker` config across entries
+ * sharing an `imageKey` is a real config mistake (ambiguous which build
+ * should win) and throws rather than silently picking one.
+ *
+ * Returns an empty array if the manifest does not exist, cannot be parsed, or
+ * contains no Lambda Docker entries. Lambdas without a `docker` block
+ * (bring-your-own-image) are skipped, not an error.
+ *
+ * Throws deliberately (not a `Result`) on divergent shared-`imageKey` docker
+ * configs even though `Result`-returning callers sit above it: the throw is a
+ * config error surfaced before any build starts, and both production
+ * boundaries convert it — the CLI's `catch` in `runApplicationDeployment`
+ * (`cli/src/services/deployment/applicationDeployment.ts`) and the webapp
+ * worker's job-level `catch` in `deploymentJobHandler`. Sanctioned per the
+ * 2026-07-16 docker-lambda review; do not re-litigate as a Pitfall-4 escape.
+ */
+export declare function parseLambdaDockerServicesFromManifest(cdkOutPath: string): ManifestDockerService[];
+/** A single container-Lambda manifest entry that declared a `docker` block. */
+export interface ManifestLambdaDockerEntry {
+    /** The Lambda's own manifest/function name (NOT the shared image key). */
+    readonly name: string;
+    /** Shared build/tag key — `imageKey` if set, else `name`. */
+    readonly imageKey: string;
+    readonly docker: DockerBuild;
+}
+/**
+ * Extract every container-Lambda manifest entry that declared a `docker`
+ * block, WITHOUT deduping by `imageKey` — unlike
+ * `parseLambdaDockerServicesFromManifest`, this preserves each function's own
+ * `name`, needed to map a built image's shared `imageKey` back to the actual
+ * Lambda function name(s) that need a fresh published version after deploy
+ * (`lambda:PublishVersion` takes a function name, not an image key).
+ */
+export declare function parseLambdaDockerEntriesFromManifest(cdkOutPath: string): ManifestLambdaDockerEntry[];
+/**
+ * Every Docker build the post-synth manifest declares, across BOTH
+ * independent namespaces: ECS service `docker` configs (`manifest.services`)
+ * and container-Lambda `docker` blocks (`manifest.lambdas`).
+ */
+export interface ManifestDockerDeclarations {
+    readonly ecsServices: ManifestDockerService[];
+    readonly lambdaEntries: ManifestLambdaDockerEntry[];
+    /**
+     * True when either namespace declares at least one build. This is the
+     * canonical "does this app need a Docker build?" presence gate — see
+     * `parseDockerDeclarationsFromManifest`.
+     */
+    readonly declaresBuild: boolean;
+}
+/**
+ * Aggregate view of every Docker build declared in the manifest. Presence
+ * gates ("should a Docker build run for this app?") MUST consume
+ * `declaresBuild` from here rather than composing the namespace parsers
+ * themselves: the namespaces are independent, and a gate that checks only one
+ * silently misses apps whose builds live entirely in the other — detection
+ * once checked only `manifest.services`, so a container-Lambda-only app never
+ * built and fell back to welcome-image seeding.
+ *
+ * When adding a new docker-carrying manifest namespace, extend this aggregate
+ * (fields + `declaresBuild`) in the same change as the build-group
+ * composition in deploy-core's `dockerBuildHelper` — the two must agree on
+ * emptiness, or presence and execution drift apart again.
+ *
+ * Never throws: both underlying parsers return `[]` on a missing or
+ * malformed manifest.
+ */
+export declare function parseDockerDeclarationsFromManifest(cdkOutPath: string): ManifestDockerDeclarations;

package/dist/manifest/io.js

@@ -1 +1 @@
-import{readFile as l,writeFile as m,unlink as g,rename as h,mkdir as y}from"fs/promises";import{readFileSync as M}from"fs";import{dirname as F,join as f}from"path";import{logger as o}from"../logger.js";import{fileExists as S}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as b}from"../constructMap.js";import{DockerBuildSchema as A,FjallManifestSchema as w,FJALL_MANIFEST_FILENAME as u,MANIFEST_SCHEMA_VERSION as x}from"./schemas.js";function p(e){return f(e,u)}async function k(e){const t=p(e);if(!await S(t))return null;try{const n=await l(t,"utf-8"),r=JSON.parse(n),i=w.safeParse(r);return i.success||o.debug("FjallManifest","Manifest validation failed",{path:t,errors:i.error.issues.map(a=>`${a.path.join(".")}: ${a.message}`)}),i.success?i.data:null}catch(n){return o.debug("FjallManifest","Failed to read manifest file",{path:t,error:d(n)}),null}}async function T(e,t){const n=p(e),r=`${n}.${Date.now()}.tmp`;await y(F(n),{recursive:!0});try{await m(r,JSON.stringify(t,null,2),"utf-8"),await h(r,n)}catch(i){try{await g(r)}catch(a){o.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:r,error:d(a)})}throw i}}function _(e){return{version:x,generatedAt:new Date().toISOString(),appName:e,services:[],lambdas:[],stacks:{}}}async function $(e){const t=await k(e);return t?.resourceMap?b(t.resourceMap):new Map}function c(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function j(e){if(!c(e)||typeof e.path!="string"||e.path.length===0)return;const t=typeof e.context=="string"&&e.context.length>0?e.context:void 0,n=typeof e.target=="string"&&e.target.length>0?e.target:void 0,r=c(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,i=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,a={path:e.path,...t!==void 0&&{context:t},...n!==void 0&&{target:n},...r!==void 0&&{buildArgs:r},...i!==void 0&&{buildSecrets:i}},s=A.safeParse(a);return s.success?s.data:void 0}function L(e){const t=f(e,u);let n;try{n=M(t,"utf-8")}catch{return o.debug("FjallManifest","Manifest file not readable \u2014 no Docker services extracted",{path:t}),[]}let r;try{r=JSON.parse(n)}catch{return o.debug("FjallManifest","Manifest is not valid JSON \u2014 no Docker services extracted",{path:t}),[]}if(!c(r)||!Array.isArray(r.services))return[];const i=[];for(const a of r.services){if(!c(a)||typeof a.name!="string")continue;const s=j(a.docker);s!==void 0&&i.push({name:a.name,docker:s})}return i}export{_ as createEmptyManifest,p as getManifestFilePath,L as parseDockerServicesFromManifest,$ as readConstructMap,k as readManifestFile,T as writeManifestFile};
+import{readFile as g,writeFile as y,unlink as M,rename as h,mkdir as F}from"fs/promises";import{readFileSync as b}from"fs";import{dirname as k,join as c}from"path";import{logger as o}from"../logger.js";import{fileExists as w}from"../fsHelpers.js";import{getErrorMessage as f}from"../errorUtils.js";import{recordToConstructMap as S}from"../constructMap.js";import{FjallManifestSchema as A,FJALL_MANIFEST_FILENAME as u,MANIFEST_SCHEMA_VERSION as x,normaliseDockerBuild as d}from"./schemas.js";function m(t){return c(t,u)}async function E(t){const r=m(t);if(!await w(r))return null;try{const n=await g(r,"utf-8"),e=JSON.parse(n),a=A.safeParse(e);return a.success||o.debug("FjallManifest","Manifest validation failed",{path:r,errors:a.error.issues.map(i=>`${i.path.join(".")}: ${i.message}`)}),a.success?a.data:null}catch(n){return o.debug("FjallManifest","Failed to read manifest file",{path:r,error:f(n)}),null}}async function K(t,r){const n=m(t),e=`${n}.${Date.now()}.tmp`;await F(k(n),{recursive:!0});try{await y(e,JSON.stringify(r,null,2),"utf-8"),await h(e,n)}catch(a){try{await M(e)}catch(i){o.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:e,error:f(i)})}throw a}}function P(t){return{version:x,generatedAt:new Date().toISOString(),appName:t,services:[],lambdas:[],stacks:{}}}async function T(t){const r=await E(t);return r?.resourceMap?S(r.resourceMap):new Map}function s(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function l(t,r){const n=c(t,u);let e;try{e=b(n,"utf-8")}catch{o.debug("FjallManifest",`Manifest file not readable \u2014 no ${r} extracted`,{path:n});return}let a;try{a=JSON.parse(e)}catch{o.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${r} extracted`,{path:n});return}return s(a)?a:void 0}function v(t){const r=l(t,"Docker services");if(r===void 0||!Array.isArray(r.services))return[];const n=[];for(const e of r.services){if(!s(e)||typeof e.name!="string")continue;const a=d(e.docker);a!==void 0&&n.push({name:e.name,docker:a})}return n}function _(t){const r=new Map;for(const{name:n,imageKey:e,docker:a}of p(t)){const i=r.get(e);if(i===void 0){r.set(e,{name:e,docker:a});continue}if(JSON.stringify(i.docker)!==JSON.stringify(a))throw new Error(`Lambda functions sharing image key "${e}" declare different \`docker\` configs \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs (offending function: "${n}").`)}return Array.from(r.values())}function p(t){const r=l(t,"Lambda Docker entries");if(r===void 0||!Array.isArray(r.lambdas))return[];const n=[];for(const e of r.lambdas){if(!s(e)||typeof e.name!="string")continue;const a=d(e.docker);if(a===void 0)continue;const i=typeof e.imageKey=="string"&&e.imageKey.length>0?e.imageKey:e.name;n.push({name:e.name,imageKey:i,docker:a})}return n}function C(t){const r=v(t),n=p(t);return{ecsServices:r,lambdaEntries:n,declaresBuild:r.length>0||n.length>0}}export{P as createEmptyManifest,m as getManifestFilePath,C as parseDockerDeclarationsFromManifest,v as parseDockerServicesFromManifest,p as parseLambdaDockerEntriesFromManifest,_ as parseLambdaDockerServicesFromManifest,T as readConstructMap,E as readManifestFile,K as writeManifestFile};

package/dist/manifest/schemas.d.ts

@@ -176,6 +176,35 @@ export type DockerBuildPartial = z.infer<typeof DockerBuildPartialSchema>;
  *   invoke this when they have a service-side `docker` to merge against.
  */
 export declare function mergeDockerBuild(service: DockerBuild, migrationsOverride: DockerBuildPartial | undefined): DockerBuild;
+/**
+ * Normalise a candidate `docker` sub-object: empty-string fields are coerced
+ * to undefined at the parser boundary so downstream consumers never have to
+ * distinguish `target: ""` from `target: undefined` (AC17).
+ *
+ * `buildArgs` is carried through verbatim — it is the only channel by which
+ * Vite-style `VITE_*` values reach the production client bundle, so dropping it
+ * here ships a bundle built with no `--build-arg` flags. A value may be a plain
+ * string (the common case) OR the public-but-sensitive object form
+ * (`DockerBuildArgValue`); both are validated by the final `DockerBuildSchema`
+ * safeParse below (a malformed value makes the whole docker candidate invalid,
+ * never throwing — safeParse returns undefined). An empty map is coerced to
+ * undefined for parity with the empty-string scalar handling.
+ *
+ * `buildSecrets` is carried through verbatim too — an empty array is coerced to
+ * undefined for parity. Each ref is validated by the final `DockerBuildSchema`
+ * safeParse below.
+ */
+export declare function normaliseDockerBuild(value: unknown): DockerBuild | undefined;
+/**
+ * Canonical comparator for "identical docker configs". Both deploy-time
+ * guards (assertNoCrossEntityBuildKeyDivergence in deploy-core's
+ * dockerBuildHelper; parseLambdaDockerServicesFromManifest in ./io.ts) and
+ * the synth-time guard (getOrCreateImageTagParameter in
+ * @fjall/components-infrastructure) must agree byte-for-byte — the
+ * fingerprint routes through normaliseDockerBuild so the empty-value
+ * coercions and field order match on every side.
+ */
+export declare function dockerBuildFingerprint(docker: DockerBuild | undefined): string | undefined;
 declare const ManifestServiceSchema: z.ZodObject<{
     name: z.ZodString;
     clusterName: z.ZodOptional<z.ZodString>;
@@ -229,6 +258,32 @@ declare const ManifestLambdaSchema: z.ZodObject<{
     secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
     ssmSecretsPath: z.ZodOptional<z.ZodString>;
     importedSecretNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    docker: z.ZodOptional<z.ZodObject<{
+        path: z.ZodString;
+        context: z.ZodOptional<z.ZodString>;
+        target: z.ZodOptional<z.ZodString>;
+        buildArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            ssm: z.ZodOptional<z.ZodString>;
+            secretsManager: z.ZodOptional<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                arn: z.ZodOptional<z.ZodString>;
+                field: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            env: z.ZodOptional<z.ZodString>;
+            acknowledgePublic: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>]>>>;
+        buildSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            ssm: z.ZodOptional<z.ZodString>;
+            secretsManager: z.ZodOptional<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                arn: z.ZodOptional<z.ZodString>;
+                field: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            env: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    imageKey: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type ManifestLambda = z.infer<typeof ManifestLambdaSchema>;
 declare const ManifestStackHashSchema: z.ZodObject<{
@@ -294,6 +349,32 @@ export declare const FjallManifestSchema: z.ZodObject<{
         secrets: z.ZodOptional<z.ZodArray<z.ZodString>>;
         ssmSecretsPath: z.ZodOptional<z.ZodString>;
         importedSecretNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        docker: z.ZodOptional<z.ZodObject<{
+            path: z.ZodString;
+            context: z.ZodOptional<z.ZodString>;
+            target: z.ZodOptional<z.ZodString>;
+            buildArgs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                ssm: z.ZodOptional<z.ZodString>;
+                secretsManager: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodOptional<z.ZodString>;
+                    arn: z.ZodOptional<z.ZodString>;
+                    field: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                env: z.ZodOptional<z.ZodString>;
+                acknowledgePublic: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>]>>>;
+            buildSecrets: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                ssm: z.ZodOptional<z.ZodString>;
+                secretsManager: z.ZodOptional<z.ZodObject<{
+                    name: z.ZodOptional<z.ZodString>;
+                    arn: z.ZodOptional<z.ZodString>;
+                    field: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>>;
+                env: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        imageKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     pattern: z.ZodOptional<z.ZodObject<{
         type: z.ZodEnum<{

package/dist/manifest/schemas.js

@@ -1 +1 @@
-import{z as e}from"zod";import{PATTERN_TYPE_VALUES as u}from"../patterns/patternTypes.js";const M="fjall-manifest.json",b=1,f=/^[A-Za-z0-9_.-]+$/,S=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(f,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),y=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),i=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),y).optional(),buildSecrets:e.array(S).optional()}).strict(),A=i.partial();function j(t,n){if(n===void 0)return t;const a=n.context??t.context,r=n.target??t.target,o=n.buildArgs??t.buildArgs,s=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...a!==void 0&&{context:a},...r!==void 0&&{target:r},...o!==void 0&&{buildArgs:o},...s!==void 0&&{buildSecrets:s}}}const c=e.object({name:e.string(),clusterName:e.string().optional(),docker:i.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),m=e.object({type:e.enum(u),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),p=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),d=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),g=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),E=e.object({version:e.literal(b),generatedAt:e.string(),appName:e.string(),services:e.array(c),lambdas:e.array(p),pattern:m.optional(),ecr:l.optional(),stacks:e.record(e.string(),d),resourceMap:e.record(e.string(),g).optional()}).strict();export{f as BUILDKIT_SECRET_ID_PATTERN,y as DockerBuildArgValueSchema,A as DockerBuildPartialSchema,i as DockerBuildSchema,S as DockerBuildSecretRefSchema,M as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,b as MANIFEST_SCHEMA_VERSION,l as ManifestEcrSchema,p as ManifestLambdaSchema,m as ManifestPatternSchema,c as ManifestServiceSchema,d as ManifestStackHashSchema,g as ResourceMapEntrySchema,j as mergeDockerBuild};
+import{z as e}from"zod";import{PATTERN_TYPE_VALUES as b}from"../patterns/patternTypes.js";const E="fjall-manifest.json",y=1,S=/^[A-Za-z0-9_.-]+$/,h=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(S,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),x=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),a=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),x).optional(),buildSecrets:e.array(h).optional()}).strict(),k=a.partial();function N(t,n){if(n===void 0)return t;const s=n.context??t.context,r=n.target??t.target,o=n.buildArgs??t.buildArgs,i=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...s!==void 0&&{context:s},...r!==void 0&&{target:r},...o!==void 0&&{buildArgs:o},...i!==void 0&&{buildSecrets:i}}}function d(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function A(t){if(!d(t)||typeof t.path!="string"||t.path.length===0)return;const n=typeof t.context=="string"&&t.context.length>0?t.context:void 0,s=typeof t.target=="string"&&t.target.length>0?t.target:void 0,r=d(t.buildArgs)&&Object.keys(t.buildArgs).length>0?t.buildArgs:void 0,o=Array.isArray(t.buildSecrets)&&t.buildSecrets.length>0?t.buildSecrets:void 0,i={path:t.path,...n!==void 0&&{context:n},...s!==void 0&&{target:s},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}},c=a.safeParse(i);return c.success?c.data:void 0}function T(t){if(t===void 0)return;const n=A(t);return n===void 0?void 0:JSON.stringify(n)}const m=e.object({name:e.string(),clusterName:e.string().optional(),docker:a.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),p=e.object({type:e.enum(b),name:e.string(),source:e.string()}).strict(),g=e.object({repositoryName:e.string()}).strict(),l=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),docker:a.optional(),imageKey:e.string().optional()}).strict(),u=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),f=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),I=e.object({version:e.literal(y),generatedAt:e.string(),appName:e.string(),services:e.array(m),lambdas:e.array(l),pattern:p.optional(),ecr:g.optional(),stacks:e.record(e.string(),u),resourceMap:e.record(e.string(),f).optional()}).strict();export{S as BUILDKIT_SECRET_ID_PATTERN,x as DockerBuildArgValueSchema,k as DockerBuildPartialSchema,a as DockerBuildSchema,h as DockerBuildSecretRefSchema,E as FJALL_MANIFEST_FILENAME,I as FjallManifestSchema,y as MANIFEST_SCHEMA_VERSION,g as ManifestEcrSchema,l as ManifestLambdaSchema,p as ManifestPatternSchema,m as ManifestServiceSchema,u as ManifestStackHashSchema,f as ResourceMapEntrySchema,T as dockerBuildFingerprint,N as mergeDockerBuild,A as normaliseDockerBuild};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "2.30.0",
+  "version": "2.31.1",
   "description": "Common utility methods",
   "type": "module",
   "main": "dist/index.js",
@@ -134,5 +134,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "ec35b16db566dfa5feb714c16f132c55b4663c86"
+  "gitHead": "a48cfaf6e050ce1736837802dfcaf517ba39f199"
 }