@fjall/util 2.30.3 → 2.31.1

package/dist/.minified

@@ -1 +1 @@
-84 files minified at 2026-07-16T01:01:28.523Z
+84 files minified at 2026-07-16T20:42:02.563Z

package/dist/infra/deployArtefacts.d.ts

@@ -44,10 +44,12 @@ export type ImageTag = z.infer<typeof ImageTagSchema>;
  * `ecrRepositoryArn` is absent for non-ECR registries.
  *
  * `functionArn`/`publishedVersion` are the Lambda analogue of
- * `taskDefinitionArn`: present only for a container-image Lambda function
- * whose image was rebuilt this deploy AND whose post-deploy
- * `lambda:PublishVersion` call succeeded (best-effort — a publish failure
- * degrades the artefact, it never fails an already-succeeded deploy).
+ * `taskDefinitionArn`: present whenever a fresh version was published for a
+ * container-image Lambda — on a full deploy via the best-effort post-deploy
+ * `lambda:PublishVersion` step (a publish failure degrades the artefact, it
+ * never fails an already-succeeded deploy), and on code-only rollouts AND
+ * rollbacks via `UpdateFunctionCode`'s `Publish: true`, which publishes
+ * alongside the update itself.
  */
 export declare const ServiceArtefactSchema: z.ZodObject<{
     serviceName: z.ZodString;

package/dist/manifest/index.d.ts

@@ -7,4 +7,4 @@
  * the barrel — the package.json `exports` map exposes both subpaths.
  */
 export { DockerBuildSchema, DockerBuildArgValueSchema, DockerBuildSecretRefSchema, DockerBuildPartialSchema, mergeDockerBuild, ManifestServiceSchema, ManifestPatternSchema, ManifestEcrSchema, ManifestLambdaSchema, ManifestStackHashSchema, ResourceMapEntrySchema, FjallManifestSchema, FJALL_MANIFEST_FILENAME, MANIFEST_SCHEMA_VERSION, BUILDKIT_SECRET_ID_PATTERN, type DockerBuild, type DockerBuildArgValue, type DockerBuildSecretRef, type DockerBuildPartial, type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ResourceMapEntry, type FjallManifest } from "./schemas.js";
-export { getManifestFilePath, readManifestFile, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, type ManifestDockerService, type ManifestLambdaDockerEntry } from "./io.js";
+export { getManifestFilePath, readManifestFile, writeManifestFile, createEmptyManifest, readConstructMap, parseDockerServicesFromManifest, parseLambdaDockerServicesFromManifest, parseLambdaDockerEntriesFromManifest, parseDockerDeclarationsFromManifest, type ManifestDockerService, type ManifestLambdaDockerEntry, type ManifestDockerDeclarations } from "./io.js";

package/dist/manifest/index.js

@@ -1 +1 @@
-import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as c,DockerBuildPartialSchema as i,mergeDockerBuild as s,ManifestServiceSchema as m,ManifestPatternSchema as S,ManifestEcrSchema as M,ManifestLambdaSchema as n,ManifestStackHashSchema as o,ResourceMapEntrySchema as f,FjallManifestSchema as h,FJALL_MANIFEST_FILENAME as E,MANIFEST_SCHEMA_VERSION as l,BUILDKIT_SECRET_ID_PATTERN as F}from"./schemas.js";import{getManifestFilePath as D,readManifestFile as k,writeManifestFile as p,createEmptyManifest as u,readConstructMap as A,parseDockerServicesFromManifest as I,parseLambdaDockerServicesFromManifest as L,parseLambdaDockerEntriesFromManifest as _}from"./io.js";export{F as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,i as DockerBuildPartialSchema,r as DockerBuildSchema,c as DockerBuildSecretRefSchema,E as FJALL_MANIFEST_FILENAME,h as FjallManifestSchema,l as MANIFEST_SCHEMA_VERSION,M as ManifestEcrSchema,n as ManifestLambdaSchema,S as ManifestPatternSchema,m as ManifestServiceSchema,o as ManifestStackHashSchema,f as ResourceMapEntrySchema,u as createEmptyManifest,D as getManifestFilePath,s as mergeDockerBuild,I as parseDockerServicesFromManifest,_ as parseLambdaDockerEntriesFromManifest,L as parseLambdaDockerServicesFromManifest,A as readConstructMap,k as readManifestFile,p as writeManifestFile};
+import{DockerBuildSchema as r,DockerBuildArgValueSchema as t,DockerBuildSecretRefSchema as c,DockerBuildPartialSchema as i,mergeDockerBuild as s,ManifestServiceSchema as m,ManifestPatternSchema as S,ManifestEcrSchema as o,ManifestLambdaSchema as M,ManifestStackHashSchema as n,ResourceMapEntrySchema as f,FjallManifestSchema as h,FJALL_MANIFEST_FILENAME as l,MANIFEST_SCHEMA_VERSION as E,BUILDKIT_SECRET_ID_PATTERN as D}from"./schemas.js";import{getManifestFilePath as d,readManifestFile as k,writeManifestFile as p,createEmptyManifest as u,readConstructMap as A,parseDockerServicesFromManifest as I,parseLambdaDockerServicesFromManifest as L,parseLambdaDockerEntriesFromManifest as _,parseDockerDeclarationsFromManifest as B}from"./io.js";export{D as BUILDKIT_SECRET_ID_PATTERN,t as DockerBuildArgValueSchema,i as DockerBuildPartialSchema,r as DockerBuildSchema,c as DockerBuildSecretRefSchema,l as FJALL_MANIFEST_FILENAME,h as FjallManifestSchema,E as MANIFEST_SCHEMA_VERSION,o as ManifestEcrSchema,M as ManifestLambdaSchema,S as ManifestPatternSchema,m as ManifestServiceSchema,n as ManifestStackHashSchema,f as ResourceMapEntrySchema,u as createEmptyManifest,d as getManifestFilePath,s as mergeDockerBuild,B as parseDockerDeclarationsFromManifest,I as parseDockerServicesFromManifest,_ as parseLambdaDockerEntriesFromManifest,L as parseLambdaDockerServicesFromManifest,A as readConstructMap,k as readManifestFile,p as writeManifestFile};

package/dist/manifest/io.d.ts

@@ -75,6 +75,14 @@ export declare function parseDockerServicesFromManifest(cdkOutPath: string): Man
  * Returns an empty array if the manifest does not exist, cannot be parsed, or
  * contains no Lambda Docker entries. Lambdas without a `docker` block
  * (bring-your-own-image) are skipped, not an error.
+ *
+ * Throws deliberately (not a `Result`) on divergent shared-`imageKey` docker
+ * configs even though `Result`-returning callers sit above it: the throw is a
+ * config error surfaced before any build starts, and both production
+ * boundaries convert it — the CLI's `catch` in `runApplicationDeployment`
+ * (`cli/src/services/deployment/applicationDeployment.ts`) and the webapp
+ * worker's job-level `catch` in `deploymentJobHandler`. Sanctioned per the
+ * 2026-07-16 docker-lambda review; do not re-litigate as a Pitfall-4 escape.
  */
 export declare function parseLambdaDockerServicesFromManifest(cdkOutPath: string): ManifestDockerService[];
 /** A single container-Lambda manifest entry that declared a `docker` block. */
@@ -94,3 +102,36 @@ export interface ManifestLambdaDockerEntry {
  * (`lambda:PublishVersion` takes a function name, not an image key).
  */
 export declare function parseLambdaDockerEntriesFromManifest(cdkOutPath: string): ManifestLambdaDockerEntry[];
+/**
+ * Every Docker build the post-synth manifest declares, across BOTH
+ * independent namespaces: ECS service `docker` configs (`manifest.services`)
+ * and container-Lambda `docker` blocks (`manifest.lambdas`).
+ */
+export interface ManifestDockerDeclarations {
+    readonly ecsServices: ManifestDockerService[];
+    readonly lambdaEntries: ManifestLambdaDockerEntry[];
+    /**
+     * True when either namespace declares at least one build. This is the
+     * canonical "does this app need a Docker build?" presence gate — see
+     * `parseDockerDeclarationsFromManifest`.
+     */
+    readonly declaresBuild: boolean;
+}
+/**
+ * Aggregate view of every Docker build declared in the manifest. Presence
+ * gates ("should a Docker build run for this app?") MUST consume
+ * `declaresBuild` from here rather than composing the namespace parsers
+ * themselves: the namespaces are independent, and a gate that checks only one
+ * silently misses apps whose builds live entirely in the other — detection
+ * once checked only `manifest.services`, so a container-Lambda-only app never
+ * built and fell back to welcome-image seeding.
+ *
+ * When adding a new docker-carrying manifest namespace, extend this aggregate
+ * (fields + `declaresBuild`) in the same change as the build-group
+ * composition in deploy-core's `dockerBuildHelper` — the two must agree on
+ * emptiness, or presence and execution drift apart again.
+ *
+ * Never throws: both underlying parsers return `[]` on a missing or
+ * malformed manifest.
+ */
+export declare function parseDockerDeclarationsFromManifest(cdkOutPath: string): ManifestDockerDeclarations;

package/dist/manifest/io.js

@@ -1 +1 @@
-import{readFile as g,writeFile as y,unlink as h,rename as M,mkdir as b}from"fs/promises";import{readFileSync as S}from"fs";import{dirname as k,join as f}from"path";import{logger as s}from"../logger.js";import{fileExists as A}from"../fsHelpers.js";import{getErrorMessage as d}from"../errorUtils.js";import{recordToConstructMap as F}from"../constructMap.js";import{DockerBuildSchema as w,FjallManifestSchema as x,FJALL_MANIFEST_FILENAME as u,MANIFEST_SCHEMA_VERSION as E}from"./schemas.js";function m(e){return f(e,u)}async function j(e){const n=m(e);if(!await A(n))return null;try{const r=await g(n,"utf-8"),t=JSON.parse(r),i=x.safeParse(t);return i.success||s.debug("FjallManifest","Manifest validation failed",{path:n,errors:i.error.issues.map(a=>`${a.path.join(".")}: ${a.message}`)}),i.success?i.data:null}catch(r){return s.debug("FjallManifest","Failed to read manifest file",{path:n,error:d(r)}),null}}async function C(e,n){const r=m(e),t=`${r}.${Date.now()}.tmp`;await b(k(r),{recursive:!0});try{await y(t,JSON.stringify(n,null,2),"utf-8"),await M(t,r)}catch(i){try{await h(t)}catch(a){s.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:t,error:d(a)})}throw i}}function T(e){return{version:E,generatedAt:new Date().toISOString(),appName:e,services:[],lambdas:[],stacks:{}}}async function _(e){const n=await j(e);return n?.resourceMap?F(n.resourceMap):new Map}function o(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function p(e){if(!o(e)||typeof e.path!="string"||e.path.length===0)return;const n=typeof e.context=="string"&&e.context.length>0?e.context:void 0,r=typeof e.target=="string"&&e.target.length>0?e.target:void 0,t=o(e.buildArgs)&&Object.keys(e.buildArgs).length>0?e.buildArgs:void 0,i=Array.isArray(e.buildSecrets)&&e.buildSecrets.length>0?e.buildSecrets:void 0,a={path:e.path,...n!==void 0&&{context:n},...r!==void 0&&{target:r},...t!==void 0&&{buildArgs:t},...i!==void 0&&{buildSecrets:i}},c=w.safeParse(a);return c.success?c.data:void 0}function l(e,n){const r=f(e,u);let t;try{t=S(r,"utf-8")}catch{s.debug("FjallManifest",`Manifest file not readable \u2014 no ${n} extracted`,{path:r});return}let i;try{i=JSON.parse(t)}catch{s.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${n} extracted`,{path:r});return}return o(i)?i:void 0}function R(e){const n=l(e,"Docker services");if(n===void 0||!Array.isArray(n.services))return[];const r=[];for(const t of n.services){if(!o(t)||typeof t.name!="string")continue;const i=p(t.docker);i!==void 0&&r.push({name:t.name,docker:i})}return r}function B(e){const n=new Map;for(const{name:r,imageKey:t,docker:i}of D(e)){const a=n.get(t);if(a===void 0){n.set(t,{name:t,docker:i});continue}if(JSON.stringify(a.docker)!==JSON.stringify(i))throw new Error(`Lambda functions sharing image key "${t}" declare different \`docker\` configs \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs (offending function: "${r}").`)}return Array.from(n.values())}function D(e){const n=l(e,"Lambda Docker entries");if(n===void 0||!Array.isArray(n.lambdas))return[];const r=[];for(const t of n.lambdas){if(!o(t)||typeof t.name!="string")continue;const i=p(t.docker);if(i===void 0)continue;const a=typeof t.imageKey=="string"&&t.imageKey.length>0?t.imageKey:t.name;r.push({name:t.name,imageKey:a,docker:i})}return r}export{T as createEmptyManifest,m as getManifestFilePath,R as parseDockerServicesFromManifest,D as parseLambdaDockerEntriesFromManifest,B as parseLambdaDockerServicesFromManifest,_ as readConstructMap,j as readManifestFile,C as writeManifestFile};
+import{readFile as g,writeFile as y,unlink as M,rename as h,mkdir as F}from"fs/promises";import{readFileSync as b}from"fs";import{dirname as k,join as c}from"path";import{logger as o}from"../logger.js";import{fileExists as w}from"../fsHelpers.js";import{getErrorMessage as f}from"../errorUtils.js";import{recordToConstructMap as S}from"../constructMap.js";import{FjallManifestSchema as A,FJALL_MANIFEST_FILENAME as u,MANIFEST_SCHEMA_VERSION as x,normaliseDockerBuild as d}from"./schemas.js";function m(t){return c(t,u)}async function E(t){const r=m(t);if(!await w(r))return null;try{const n=await g(r,"utf-8"),e=JSON.parse(n),a=A.safeParse(e);return a.success||o.debug("FjallManifest","Manifest validation failed",{path:r,errors:a.error.issues.map(i=>`${i.path.join(".")}: ${i.message}`)}),a.success?a.data:null}catch(n){return o.debug("FjallManifest","Failed to read manifest file",{path:r,error:f(n)}),null}}async function K(t,r){const n=m(t),e=`${n}.${Date.now()}.tmp`;await F(k(n),{recursive:!0});try{await y(e,JSON.stringify(r,null,2),"utf-8"),await h(e,n)}catch(a){try{await M(e)}catch(i){o.debug("FjallManifest","Temp file cleanup failed (non-fatal)",{path:e,error:f(i)})}throw a}}function P(t){return{version:x,generatedAt:new Date().toISOString(),appName:t,services:[],lambdas:[],stacks:{}}}async function T(t){const r=await E(t);return r?.resourceMap?S(r.resourceMap):new Map}function s(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function l(t,r){const n=c(t,u);let e;try{e=b(n,"utf-8")}catch{o.debug("FjallManifest",`Manifest file not readable \u2014 no ${r} extracted`,{path:n});return}let a;try{a=JSON.parse(e)}catch{o.debug("FjallManifest",`Manifest is not valid JSON \u2014 no ${r} extracted`,{path:n});return}return s(a)?a:void 0}function v(t){const r=l(t,"Docker services");if(r===void 0||!Array.isArray(r.services))return[];const n=[];for(const e of r.services){if(!s(e)||typeof e.name!="string")continue;const a=d(e.docker);a!==void 0&&n.push({name:e.name,docker:a})}return n}function _(t){const r=new Map;for(const{name:n,imageKey:e,docker:a}of p(t)){const i=r.get(e);if(i===void 0){r.set(e,{name:e,docker:a});continue}if(JSON.stringify(i.docker)!==JSON.stringify(a))throw new Error(`Lambda functions sharing image key "${e}" declare different \`docker\` configs \u2014 every Lambda function sharing an \`image\` must build from the identical Dockerfile/context/target/buildArgs (offending function: "${n}").`)}return Array.from(r.values())}function p(t){const r=l(t,"Lambda Docker entries");if(r===void 0||!Array.isArray(r.lambdas))return[];const n=[];for(const e of r.lambdas){if(!s(e)||typeof e.name!="string")continue;const a=d(e.docker);if(a===void 0)continue;const i=typeof e.imageKey=="string"&&e.imageKey.length>0?e.imageKey:e.name;n.push({name:e.name,imageKey:i,docker:a})}return n}function C(t){const r=v(t),n=p(t);return{ecsServices:r,lambdaEntries:n,declaresBuild:r.length>0||n.length>0}}export{P as createEmptyManifest,m as getManifestFilePath,C as parseDockerDeclarationsFromManifest,v as parseDockerServicesFromManifest,p as parseLambdaDockerEntriesFromManifest,_ as parseLambdaDockerServicesFromManifest,T as readConstructMap,E as readManifestFile,K as writeManifestFile};

package/dist/manifest/schemas.d.ts

@@ -176,6 +176,35 @@ export type DockerBuildPartial = z.infer<typeof DockerBuildPartialSchema>;
  *   invoke this when they have a service-side `docker` to merge against.
  */
 export declare function mergeDockerBuild(service: DockerBuild, migrationsOverride: DockerBuildPartial | undefined): DockerBuild;
+/**
+ * Normalise a candidate `docker` sub-object: empty-string fields are coerced
+ * to undefined at the parser boundary so downstream consumers never have to
+ * distinguish `target: ""` from `target: undefined` (AC17).
+ *
+ * `buildArgs` is carried through verbatim — it is the only channel by which
+ * Vite-style `VITE_*` values reach the production client bundle, so dropping it
+ * here ships a bundle built with no `--build-arg` flags. A value may be a plain
+ * string (the common case) OR the public-but-sensitive object form
+ * (`DockerBuildArgValue`); both are validated by the final `DockerBuildSchema`
+ * safeParse below (a malformed value makes the whole docker candidate invalid,
+ * never throwing — safeParse returns undefined). An empty map is coerced to
+ * undefined for parity with the empty-string scalar handling.
+ *
+ * `buildSecrets` is carried through verbatim too — an empty array is coerced to
+ * undefined for parity. Each ref is validated by the final `DockerBuildSchema`
+ * safeParse below.
+ */
+export declare function normaliseDockerBuild(value: unknown): DockerBuild | undefined;
+/**
+ * Canonical comparator for "identical docker configs". Both deploy-time
+ * guards (assertNoCrossEntityBuildKeyDivergence in deploy-core's
+ * dockerBuildHelper; parseLambdaDockerServicesFromManifest in ./io.ts) and
+ * the synth-time guard (getOrCreateImageTagParameter in
+ * @fjall/components-infrastructure) must agree byte-for-byte — the
+ * fingerprint routes through normaliseDockerBuild so the empty-value
+ * coercions and field order match on every side.
+ */
+export declare function dockerBuildFingerprint(docker: DockerBuild | undefined): string | undefined;
 declare const ManifestServiceSchema: z.ZodObject<{
     name: z.ZodString;
     clusterName: z.ZodOptional<z.ZodString>;

package/dist/manifest/schemas.js

@@ -1 +1 @@
-import{z as e}from"zod";import{PATTERN_TYPE_VALUES as u}from"../patterns/patternTypes.js";const M="fjall-manifest.json",b=1,f=/^[A-Za-z0-9_.-]+$/,y=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(f,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),S=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),o=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),S).optional(),buildSecrets:e.array(y).optional()}).strict(),A=o.partial();function j(t,n){if(n===void 0)return t;const a=n.context??t.context,r=n.target??t.target,s=n.buildArgs??t.buildArgs,i=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...a!==void 0&&{context:a},...r!==void 0&&{target:r},...s!==void 0&&{buildArgs:s},...i!==void 0&&{buildSecrets:i}}}const c=e.object({name:e.string(),clusterName:e.string().optional(),docker:o.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),m=e.object({type:e.enum(u),name:e.string(),source:e.string()}).strict(),l=e.object({repositoryName:e.string()}).strict(),p=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),docker:o.optional(),imageKey:e.string().optional()}).strict(),d=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),g=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),E=e.object({version:e.literal(b),generatedAt:e.string(),appName:e.string(),services:e.array(c),lambdas:e.array(p),pattern:m.optional(),ecr:l.optional(),stacks:e.record(e.string(),d),resourceMap:e.record(e.string(),g).optional()}).strict();export{f as BUILDKIT_SECRET_ID_PATTERN,S as DockerBuildArgValueSchema,A as DockerBuildPartialSchema,o as DockerBuildSchema,y as DockerBuildSecretRefSchema,M as FJALL_MANIFEST_FILENAME,E as FjallManifestSchema,b as MANIFEST_SCHEMA_VERSION,l as ManifestEcrSchema,p as ManifestLambdaSchema,m as ManifestPatternSchema,c as ManifestServiceSchema,d as ManifestStackHashSchema,g as ResourceMapEntrySchema,j as mergeDockerBuild};
+import{z as e}from"zod";import{PATTERN_TYPE_VALUES as b}from"../patterns/patternTypes.js";const E="fjall-manifest.json",y=1,S=/^[A-Za-z0-9_.-]+$/,h=e.object({id:e.string().min(1,"buildSecret id cannot be empty").regex(S,"buildSecret id may contain only letters, digits, '_', '.', and '-' (no comma, '=', or whitespace, which would break the buildx --secret argv)"),ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildSecret requires exactly one source (ssm, secretsManager, or env)"})}),x=e.union([e.string(),e.object({ssm:e.string().min(1,"ssm parameter name cannot be empty").optional(),secretsManager:e.object({name:e.string().min(1,"secret name cannot be empty").optional(),arn:e.string().min(1,"secret arn cannot be empty").optional(),field:e.string().min(1,"secret field cannot be empty").optional()}).strict().refine(t=>t.name===void 0!=(t.arn===void 0),"secretsManager requires exactly one of name or arn").optional(),env:e.string().min(1,"env variable name cannot be empty").optional(),acknowledgePublic:e.boolean().optional()}).strict().superRefine((t,n)=>{[t.ssm,t.secretsManager,t.env].filter(r=>r!==void 0).length!==1&&n.addIssue({code:e.ZodIssueCode.custom,message:"buildArg value requires exactly one source (ssm, secretsManager, or env)"})})]),a=e.object({path:e.string(),context:e.string().min(1,"context cannot be empty").optional(),target:e.string().min(1,"target cannot be empty").optional(),buildArgs:e.record(e.string(),x).optional(),buildSecrets:e.array(h).optional()}).strict(),k=a.partial();function N(t,n){if(n===void 0)return t;const s=n.context??t.context,r=n.target??t.target,o=n.buildArgs??t.buildArgs,i=n.buildSecrets??t.buildSecrets;return{path:n.path??t.path,...s!==void 0&&{context:s},...r!==void 0&&{target:r},...o!==void 0&&{buildArgs:o},...i!==void 0&&{buildSecrets:i}}}function d(t){return typeof t=="object"&&t!==null&&!Array.isArray(t)}function A(t){if(!d(t)||typeof t.path!="string"||t.path.length===0)return;const n=typeof t.context=="string"&&t.context.length>0?t.context:void 0,s=typeof t.target=="string"&&t.target.length>0?t.target:void 0,r=d(t.buildArgs)&&Object.keys(t.buildArgs).length>0?t.buildArgs:void 0,o=Array.isArray(t.buildSecrets)&&t.buildSecrets.length>0?t.buildSecrets:void 0,i={path:t.path,...n!==void 0&&{context:n},...s!==void 0&&{target:s},...r!==void 0&&{buildArgs:r},...o!==void 0&&{buildSecrets:o}},c=a.safeParse(i);return c.success?c.data:void 0}function T(t){if(t===void 0)return;const n=A(t);return n===void 0?void 0:JSON.stringify(n)}const m=e.object({name:e.string(),clusterName:e.string().optional(),docker:a.optional(),containerPort:e.number().optional(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional()}).strict(),p=e.object({type:e.enum(b),name:e.string(),source:e.string()}).strict(),g=e.object({repositoryName:e.string()}).strict(),l=e.object({name:e.string(),secrets:e.array(e.string()).optional(),ssmSecretsPath:e.string().optional(),importedSecretNames:e.array(e.string()).optional(),docker:a.optional(),imageKey:e.string().optional()}).strict(),u=e.object({templateHash:e.string(),synthTimestamp:e.string()}).strict(),f=e.object({constructPath:e.string().max(512),group:e.string().max(128),resourceType:e.string().max(256)}).strict(),I=e.object({version:e.literal(y),generatedAt:e.string(),appName:e.string(),services:e.array(m),lambdas:e.array(l),pattern:p.optional(),ecr:g.optional(),stacks:e.record(e.string(),u),resourceMap:e.record(e.string(),f).optional()}).strict();export{S as BUILDKIT_SECRET_ID_PATTERN,x as DockerBuildArgValueSchema,k as DockerBuildPartialSchema,a as DockerBuildSchema,h as DockerBuildSecretRefSchema,E as FJALL_MANIFEST_FILENAME,I as FjallManifestSchema,y as MANIFEST_SCHEMA_VERSION,g as ManifestEcrSchema,l as ManifestLambdaSchema,p as ManifestPatternSchema,m as ManifestServiceSchema,u as ManifestStackHashSchema,f as ResourceMapEntrySchema,T as dockerBuildFingerprint,N as mergeDockerBuild,A as normaliseDockerBuild};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "2.30.3",
+  "version": "2.31.1",
   "description": "Common utility methods",
   "type": "module",
   "main": "dist/index.js",
@@ -134,5 +134,5 @@
   "engines": {
     "node": ">=22.0.0"
   },
-  "gitHead": "d398edc0c0edf661d7ab6e5a47623529f68dfd2a"
+  "gitHead": "a48cfaf6e050ce1736837802dfcaf517ba39f199"
 }