grada-run 0.0.2 → 0.32.0

package/src/utils/db-tunnel.js

@@ -0,0 +1,164 @@
+import { ListTasksCommand, DescribeTasksCommand } from '@aws-sdk/client-ecs';
+import { GetSecretValueCommand } from '@aws-sdk/client-secrets-manager';
+import { spawnSync } from 'child_process';
+import net from 'node:net';
+import { pickRuntimeContainer } from './ecs.js';
+import { pollUntil } from './system.js';
+
+// SSM port-forwarding session arguments for tunneling to a database
+// through an ECS container. `remotePort` is the database port (5432 for
+// PostgreSQL/Aurora, 3306 for MySQL); `localPort` is the loopback port.
+export function buildSsmArgs({ cluster, taskId, runtimeId, dbHost, remotePort = '5432', localPort, region }) {
+    const args = [
+        'ssm', 'start-session',
+        '--target', `ecs:${cluster}_${taskId}_${runtimeId}`,
+        '--document-name', 'AWS-StartPortForwardingSessionToRemoteHost',
+        '--parameters', `{"host":["${dbHost}"],"portNumber":["${remotePort}"],"localPortNumber":["${localPort}"]}`,
+    ];
+    if (region) args.push('--region', region);
+    return args;
+}
+
+// Fetches the managed master credentials for `secretArn`. Returns
+// `{ username, password }`, or `null` when the secret is missing or
+// malformed (callers report SECRET_MALFORMED).
+export async function fetchManagedDbCredentials(secretsClient, secretArn) {
+    const secretResp = await secretsClient.send(
+        new GetSecretValueCommand({ SecretId: secretArn })
+    );
+    try {
+        const parsed = JSON.parse(secretResp.SecretString || '{}');
+        if (parsed.username && parsed.password) {
+            return { username: parsed.username, password: parsed.password };
+        }
+        return null;
+    } catch {
+        return null;
+    }
+}
+
+// Picks a running ECS task to act as the SSM jump host. Returns
+// `{ taskArn, taskId, containerName, runtimeId }`, or `{ error }` with
+// `NO_RUNNING_TASKS` / `NO_RUNTIME_ID` for the caller to report.
+export async function findJumpHostTarget(ecsClient, { cluster, service, expectedContainer }) {
+    const listResp = await ecsClient.send(
+        new ListTasksCommand({ cluster, serviceName: service, desiredStatus: 'RUNNING', maxResults: 10 })
+    );
+    const taskArns = listResp.taskArns || [];
+    if (taskArns.length === 0) return { error: 'NO_RUNNING_TASKS' };
+    const descResp = await ecsClient.send(
+        new DescribeTasksCommand({ cluster, tasks: taskArns.slice(0, 1) })
+    );
+    const task = (descResp.tasks || [])[0] || null;
+    if (!task?.taskArn) return { error: 'NO_RUNNING_TASKS' };
+    const container = pickRuntimeContainer(task, expectedContainer);
+    const runtimeId = container?.runtimeId;
+    if (!runtimeId) return { error: 'NO_RUNTIME_ID' };
+    return {
+        taskArn: task.taskArn,
+        taskId: task.taskArn.split('/').pop(),
+        containerName: container?.name,
+        runtimeId,
+    };
+}
+
+function probeTcpPort(host, port, timeoutMs = 2000) {
+    return new Promise((resolve) => {
+        const socket = net.connect({ host, port });
+        const done = (open) => {
+            socket.destroy();
+            resolve(open);
+        };
+        socket.once('connect', () => done(true));
+        socket.once('error', () => done(false));
+        socket.setTimeout(timeoutMs, () => done(false));
+    });
+}
+
+// Waits until `host:port` accepts TCP connections (an SSM tunnel coming
+// up). Resolves `{ done: true }`, or `{ timedOut: true }` after `timeoutMs`.
+export async function waitForTcpPort(host, port, { timeoutMs = 30000, pollIntervalMs = 500 } = {}) {
+    return pollUntil({
+        intervalMs: pollIntervalMs,
+        timeoutMs,
+        onTick: async () => {
+            const open = await probeTcpPort(host, port);
+            return open ? { done: true, value: true } : { done: false };
+        },
+    });
+}
+
+// Allocates an ephemeral free loopback port so background tunnels never
+// collide with a local Postgres/MySQL on 5432/3306.
+export function getFreeLocalPort(host = '127.0.0.1') {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.once('error', reject);
+        server.listen(0, host, () => {
+            const { port } = server.address();
+            server.close(() => resolve(port));
+        });
+    });
+}
+
+// Masks the password in a `scheme://user:password@host/...` URI for safe
+// terminal and error output. URIs without userinfo pass through unchanged.
+export function redactUri(uri) {
+    const text = String(uri ?? '');
+    const schemeIdx = text.indexOf('://');
+    if (schemeIdx === -1) return text;
+    const authStart = schemeIdx + 3;
+    const slashIdx = text.indexOf('/', authStart);
+    const authEnd = slashIdx === -1 ? text.length : slashIdx;
+    const authority = text.slice(authStart, authEnd);
+    const atIdx = authority.lastIndexOf('@');
+    if (atIdx === -1) return text;
+    const userinfo = authority.slice(0, atIdx);
+    const colonIdx = userinfo.indexOf(':');
+    if (colonIdx === -1) return text;
+    return text.slice(0, authStart) + userinfo.slice(0, colonIdx) + ':****' + text.slice(authStart + atIdx);
+}
+
+// Parses a `--from` source URI into discrete connection parts (so passwords
+// travel via process env, never argv). Returns `{ scheme, user, password,
+// host, port, database }`, or `null` when the URI is unusable.
+export function parseSourceUri(uri) {
+    const text = String(uri ?? '').trim();
+    const match = /^(postgres(?:ql)?|mysql):\/\/(.*)$/i.exec(text);
+    if (!match) return null;
+    const scheme = match[1].toLowerCase() === 'mysql' ? 'mysql' : 'postgresql';
+    let parsed;
+    try {
+        // WHATWG URL requires a valid scheme; normalize postgres:// first.
+        parsed = new URL(text.replace(/^[a-z]+:\/\//i, `${scheme}://`));
+    } catch {
+        return null;
+    }
+    if (!parsed.hostname) return null;
+    const database = decodeURIComponent(parsed.pathname.replace(/^\//, '').split('/')[0] || '');
+    if (!database) return null;
+    return {
+        scheme,
+        user: decodeURIComponent(parsed.username || ''),
+        password: decodeURIComponent(parsed.password || ''),
+        host: parsed.hostname,
+        port: parsed.port || (scheme === 'mysql' ? '3306' : '5432'),
+        database,
+    };
+}
+
+// Reports which of `names` are missing from PATH (via `<bin> --version`,
+// mirroring the Session Manager plugin check). Pure ENOENT detection:
+// a binary that spawns at all counts as present.
+export function findMissingBinaries(names, { spawnSyncImpl = spawnSync } = {}) {
+    const missing = [];
+    for (const name of names || []) {
+        try {
+            const result = spawnSyncImpl(name, ['--version'], { stdio: 'ignore' });
+            if (result && result.error && result.error.code === 'ENOENT') missing.push(name);
+        } catch {
+            missing.push(name);
+        }
+    }
+    return missing;
+}

package/src/utils/detector.js

@@ -0,0 +1,298 @@
+import fsSync from 'fs';
+import path from 'path';
+
+export { detectProjectCapabilities } from './capabilities.js';
+
+// Detects the framework based on the presence of framework-specific files.
+export function detectFramework(targetDir) {
+    const packageJsonPath = path.join(targetDir, 'package.json');
+    const requirementsTxtPath = path.join(targetDir, 'requirements.txt');
+    const managePyPath = path.join(targetDir, 'manage.py');
+    const goModPath = path.join(targetDir, 'go.mod');
+    const gemfilePath = path.join(targetDir, 'Gemfile');
+
+    // 1. Detect Node.js Frameworks
+    if (fsSync.existsSync(packageJsonPath)) {
+        try {
+            const pkg = JSON.parse(fsSync.readFileSync(packageJsonPath, 'utf-8'));
+            // Merge dependencies and devDependencies to check both
+            const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
+
+            // Fullstack / API
+            if (deps['@nestjs/core']) return { id: 'nestjs', name: 'NestJS' };
+            if (deps['next']) return { id: 'nextjs', name: 'Next.js' };
+            if (deps['nuxt']) return { id: 'nuxt', name: 'Nuxt 3 (SSR)' };
+            if (deps['express']) return { id: 'node', name: 'Node.js / Express' };
+
+            // Explicit SvelteKit SSR Detection
+            if (deps['@sveltejs/kit']) return { id: 'svelte', name: 'SvelteKit SSR', buildDir: 'build' };
+
+            // Static Site Generators & SPAs (with precise build directories)
+            if (deps['@sveltejs/kit']) return { id: 'static', name: 'SvelteKit', buildDir: 'build' };
+            if (deps['react-scripts']) return { id: 'static', name: 'Create React App', buildDir: 'build' };
+            if (deps['gatsby']) return { id: 'static', name: 'Gatsby', buildDir: 'public' };
+            if (deps['astro']) return { id: 'static', name: 'Astro', buildDir: 'dist' };
+            if (deps['vite']) return { id: 'static', name: 'Vite', buildDir: 'dist' };
+            if (deps['@vue/cli-service']) return { id: 'static', name: 'Vue.js', buildDir: 'dist' };
+            if (deps['@angular/cli']) return { id: 'static', name: 'Angular', buildDir: 'dist' };
+        } catch (e) {
+            // Silently fail if package.json is malformed
+        }
+    }
+
+    // 2. Detect Python Frameworks
+    if (fsSync.existsSync(requirementsTxtPath)) {
+        try {
+            const reqs = fsSync.readFileSync(requirementsTxtPath, 'utf-8').toLowerCase();
+            if (reqs.includes('fastapi')) return { id: 'python', name: 'Python FastAPI' };
+            if (reqs.includes('django')) return { id: 'django', name: 'Django' };
+        } catch (e) {
+            // Silently fail
+        }
+    }
+
+    // Fallback Django detection (sometimes requirements.txt is named differently)
+    if (fsSync.existsSync(managePyPath)) return { id: 'django', name: 'Django' };
+
+    // 3. Detect Ruby on Rails
+    if (fsSync.existsSync(gemfilePath)) {
+        try {
+            const gemfile = fsSync.readFileSync(gemfilePath, 'utf-8').toLowerCase();
+            if (/gem\s+['"]rails['"]/i.test(gemfile)) { return { id: 'rails', name: 'Ruby on Rails' }; }
+        } catch (e) {
+            // Silently fail
+        }
+    }
+
+    // 4. Detect Go
+    if (fsSync.existsSync(goModPath)) return { id: 'go', name: 'Go' };
+
+    // 5. Fallback
+    return null;
+}
+
+// Splits a Procfile-style command into Terraform's JSON-array form,
+// respecting single and double quotes. Shared by Procfile parsing and
+// the interactive worker-command prompt so both produce identical arrays.
+export function splitProcfileCommand(rawCommand) {
+    const match = String(rawCommand || '').match(/[^\s"']+|"([^"]*)"|'([^']*)'/g);
+    if (!match) return [];
+    return match.map(str => str.replace(/^["']|["']$/g, '')); // Strip the quotes
+}
+
+// Parses a Heroku/Render Procfile and formats the commands for Terraform ECS.
+export function parseProcfile(targetDir) {
+    const procfilePath = path.join(targetDir, 'Procfile');
+
+    if (!fsSync.existsSync(procfilePath)) return null;
+
+    const content = fsSync.readFileSync(procfilePath, 'utf-8');
+    const processes = {};
+
+    // Match lines like "web: gunicorn myapp.wsgi"
+    const lines = content.split('\n');
+    const procRegex = /^([A-Za-z0-9_-]+):\s*(.+)$/;
+
+    for (const line of lines) {
+        const match = line.trim().match(procRegex);
+        if (match) {
+            const type = match[1].toLowerCase();
+            const rawCommand = match[2].trim();
+
+            // Terraform requires the command as a JSON array of strings
+            const commandArray = splitProcfileCommand(rawCommand);
+
+            processes[type] = commandArray;
+        }
+    }
+
+    return Object.keys(processes).length > 0 ? processes : null;
+}
+
+// Parses a vercel.json file to extract routing and edge rules
+export function parseVercelConfig(targetDir) {
+    const vercelConfigPath = path.join(targetDir, 'vercel.json');
+    if (!fsSync.existsSync(vercelConfigPath)) return null;
+
+    try {
+        const content = fsSync.readFileSync(vercelConfigPath, 'utf-8');
+        const vercelJson = JSON.parse(content);
+
+        // We only care about network-level edge rules that AWS needs to handle
+        const rules = {
+            redirects: vercelJson.redirects || null,
+            headers: vercelJson.headers || null,
+            rewrites: vercelJson.rewrites || null
+        };
+
+        // If it's just an empty vercel.json, return null
+        if (!rules.redirects && !rules.headers && !rules.rewrites) {
+            return null;
+        }
+
+        return rules;
+    } catch (e) {
+        // Silently fail on malformed JSON
+        return null;
+    }
+}
+
+// Checks if Next.js is configured for 'standalone' output
+export function analyzeNextConfig(targetDir) {
+    const extensions = ['js', 'mjs', 'cjs', 'ts'];
+    let configPath = null;
+    let configContent = '';
+
+    for (const ext of extensions) {
+        const tempPath = path.join(targetDir, `next.config.${ext}`);
+        if (fsSync.existsSync(tempPath)) {
+            configPath = tempPath;
+            configContent = fsSync.readFileSync(tempPath, 'utf-8');
+            break;
+        }
+    }
+
+    if (!configPath) return { hasConfig: false, isStandalone: false };
+
+    // Regex looks for output: 'standalone' or output: "standalone" (handling spacing)
+    const isStandalone = /output\s*:\s*['"`]standalone['"`]/.test(configContent);
+
+    return {
+        hasConfig: true,
+        isStandalone: isStandalone,
+        configPath: configPath
+    };
+}
+
+// Checks if SvelteKit is locked into Vercel
+export function analyzeSvelteConfig(targetDir) {
+    const configPath = path.join(targetDir, 'svelte.config.js');
+    if (!fsSync.existsSync(configPath)) return { hasConfig: false, adapter: 'unknown' };
+
+    const content = fsSync.readFileSync(configPath, 'utf-8');
+
+    let adapter = 'unknown';
+    if (content.includes('@sveltejs/adapter-vercel')) adapter = 'vercel';
+    else if (content.includes('@sveltejs/adapter-node')) adapter = 'node';
+    else if (content.includes('@sveltejs/adapter-static')) adapter = 'static';
+    else if (content.includes('@sveltejs/adapter-auto')) adapter = 'auto'; // Vercel's default
+
+    return { hasConfig: true, adapter };
+}
+
+// Checks if Astro is locked into Vercel
+export function analyzeAstroConfig(targetDir) {
+    const extensions = ['mjs', 'js', 'ts', 'cjs'];
+    let configPath = null;
+    let content = '';
+
+    for (const ext of extensions) {
+        const tempPath = path.join(targetDir, `astro.config.${ext}`);
+        if (fsSync.existsSync(tempPath)) {
+            configPath = tempPath;
+            content = fsSync.readFileSync(tempPath, 'utf-8');
+            break;
+        }
+    }
+
+    if (!configPath) return { hasConfig: false, adapter: 'unknown' };
+
+    let adapter = 'unknown';
+    if (content.includes('@astrojs/vercel')) adapter = 'vercel';
+    else if (content.includes('@astrojs/node')) adapter = 'node';
+
+    return { hasConfig: true, adapter };
+}
+
+// Detects the project's schema-migration command from well-known ORM and
+// framework markers. Pure: reads files under `cwd`, never throws (malformed
+// or unreadable files fall through to the next marker). Returns the shell
+// command string or null when nothing matches.
+export function detectMigrationCommand(cwd = process.cwd()) {
+    const readJson = (file) => {
+        try {
+            return JSON.parse(fsSync.readFileSync(path.join(cwd, file), 'utf-8'));
+        } catch {
+            return null;
+        }
+    };
+    const exists = (file) => {
+        try {
+            return fsSync.existsSync(path.join(cwd, file));
+        } catch {
+            return false;
+        }
+    };
+
+    // 1. Explicit package.json migration scripts win over framework markers.
+    const pkg = readJson('package.json');
+    const scripts = pkg && typeof pkg === 'object' ? pkg.scripts || {} : {};
+    if (typeof scripts['db:migrate'] === 'string' && scripts['db:migrate'].trim()) {
+        return 'npm run db:migrate';
+    }
+    if (typeof scripts.migrate === 'string' && scripts.migrate.trim()) {
+        return 'npm run migrate';
+    }
+
+    // 2. Prisma: schema file or dependency in either dep block.
+    const deps = pkg && typeof pkg === 'object'
+        ? { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }
+        : {};
+    if (exists(path.join('prisma', 'schema.prisma')) || deps.prisma) {
+        return 'npx prisma migrate deploy';
+    }
+
+    // 3. Drizzle: config file in any supported extension.
+    if (exists('drizzle.config.ts') || exists('drizzle.config.js') || exists('drizzle.config.mjs')) {
+        return 'npx drizzle-kit migrate';
+    }
+
+    // 4. Alembic.
+    if (exists('alembic.ini')) {
+        return 'alembic upgrade head';
+    }
+
+    // 5. Django.
+    if (exists('manage.py')) {
+        return 'python manage.py migrate --noinput';
+    }
+
+    // 6. Ruby on Rails: binstub or Gemfile rails dependency.
+    if (exists(path.join('bin', 'rails'))) {
+        return 'bundle exec rails db:migrate';
+    }
+    try {
+        const gemfilePath = path.join(cwd, 'Gemfile');
+        if (fsSync.existsSync(gemfilePath)) {
+            const gemfile = fsSync.readFileSync(gemfilePath, 'utf-8');
+            if (/gem\s+['"]rails['"]/i.test(gemfile)) {
+                return 'bundle exec rails db:migrate';
+            }
+        }
+    } catch {
+        // Fall through to null below.
+    }
+
+    return null;
+}
+
+// Checks if a NestJS app explicitly listens on 0.0.0.0 for Docker networking
+export function analyzeNestApp(targetDir) {
+    const mainTsPath = path.join(targetDir, 'src', 'main.ts');
+    const mainJsPath = path.join(targetDir, 'src', 'main.js');
+
+    const filePath = fsSync.existsSync(mainTsPath) ? mainTsPath : (fsSync.existsSync(mainJsPath) ? mainJsPath : null);
+    if (!filePath) return { hasMain: false, listensOnAllInterfaces: true };
+
+    try {
+        const content = fsSync.readFileSync(filePath, 'utf-8');
+        const hasHostBinding = content.includes('0.0.0.0');
+        return {
+            hasMain: true,
+            listensOnAllInterfaces: hasHostBinding,
+            filePath: path.relative(targetDir, filePath)
+        };
+    } catch {
+        return { hasMain: false, listensOnAllInterfaces: true };
+    }
+}

package/src/utils/dockerCompose.js

@@ -0,0 +1,65 @@
+import fs from 'fs';
+import path from 'path';
+import { load } from 'js-yaml';
+
+// Parse docker-compose.yml (or its aliases) and normalize it into an
+// array of services. Filenames are checked in canonical order.
+const COMPOSE_FILENAMES = ['docker-compose.yml', 'docker-compose.yaml', 'compose.yml', 'compose.yaml'];
+
+export function parseDockerCompose(targetDir) {
+    let composePath = null;
+    for (const filename of COMPOSE_FILENAMES) {
+        const candidate = path.join(targetDir, filename);
+        if (fs.existsSync(candidate)) {
+            composePath = candidate;
+            break;
+        }
+    }
+
+    if (!composePath) return null;
+
+    try {
+        const fileContents = fs.readFileSync(composePath, 'utf8');
+        const data = load(fileContents);
+
+        if (!data || !data.services) return null;
+
+        const services = [];
+
+        for (const [name, config] of Object.entries(data.services)) {
+            // Extract the container port (e.g., "8080:80" -> 80)
+            let exposedPort = null;
+            if (config.ports && config.ports.length > 0) {
+                // Handle different port formats like "3000" or "8000:8000" or "127.0.0.1:8001:8001"
+                const portMapping = config.ports[0].toString();
+                const parts = portMapping.split(':');
+                exposedPort = parseInt(parts[parts.length - 1].replace(/[^0-9]/g, ''), 10);
+            }
+
+            // Normalize environment variables from Array or Object
+            let envVars = {};
+            if (Array.isArray(config.environment)) {
+                config.environment.forEach(env => {
+                    const [key, ...val] = env.split('=');
+                    if (key) envVars[key] = val.join('=');
+                });
+            } else if (typeof config.environment === 'object') {
+                envVars = config.environment;
+            }
+
+            services.push({
+                name,
+                build: config.build || null,
+                image: config.image || null,
+                port: exposedPort,
+                command: config.command || null,
+                environment: envVars
+            });
+        }
+
+        return services;
+    } catch (e) {
+        console.error('⚠️ Failed to parse Docker Compose file:', e.message);
+        return null;
+    }
+}

package/src/utils/domains.js

@@ -0,0 +1,73 @@
+// Shared domain/zone/email validation and `domain.tf` parsing for the
+// `domain` command and `add email:ses`. Both commands consume this module
+// so their normalization rules can never drift apart. Dependency-free.
+export const DOMAIN_REGEX = /^(?=.{1,253}$)(\*\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/;
+export const ZONE_ID_REGEX = /^(?:\/hostedzone\/)?(Z[A-Z0-9]{1,32})$/;
+export const FROM_EMAIL_REGEX = /^[^\s@"'\\]+@[^\s@"'\\]+\.[^\s@"'\\]+$/;
+
+export const DOMAIN_MODES = ['route53', 'external-pending', 'external-active'];
+
+// Trims whitespace, strips one trailing FQDN dot, and lowercases.
+// Non-string input normalizes to '' so callers fail validation instead
+// of throwing.
+export function normalizeDomain(input) {
+    if (typeof input !== 'string') return '';
+    return input.trim().toLowerCase().replace(/\.$/, '');
+}
+
+// Validates a normalized domain (with an optional `*.` wildcard prefix).
+export function isValidDomain(domain) {
+    return DOMAIN_REGEX.test(normalizeDomain(domain));
+}
+
+// Strips an optional `/hostedzone/` prefix (as copied from the AWS
+// console) and validates the `Z...` shape. Returns the canonical zone
+// ID, or null when invalid.
+export function normalizeZoneId(input) {
+    if (typeof input !== 'string') return null;
+    const match = ZONE_ID_REGEX.exec(input.trim());
+    return match ? match[1] : null;
+}
+
+// Validates sender-address syntax and that the address belongs to
+// `expectedDomain` (or one of its subdomains), so SES sends never fail
+// at runtime against an unverified identity. Wildcards are rejected on
+// both sides: SES domain identities do not support them.
+export function isValidFromEmail(email, expectedDomain) {
+    if (typeof email !== 'string' || typeof expectedDomain !== 'string') return false;
+    const address = email.trim();
+    if (!FROM_EMAIL_REGEX.test(address)) return false;
+    if (address.includes('*')) return false;
+    const domain = normalizeDomain(expectedDomain);
+    if (!domain || domain.includes('*')) return false;
+    const addressDomain = address.slice(address.lastIndexOf('@') + 1).toLowerCase();
+    return addressDomain === domain || addressDomain.endsWith(`.${domain}`);
+}
+
+// Parses a `terraform/domain.tf` document into `{ domain, mode, zoneId }`
+// (fields are null when absent). Mode comes from the
+// `# grada:domain-mode=<mode>` marker (legacy `# deploy-stack:` files
+// still parse) with structural fallbacks for hand-edited files; the
+// zone ID prefers the explicit `# grada:zone-id=<id>` marker over
+// `zone_id` attributes.
+export function parseDomainTf(content) {
+    const text = String(content ?? '');
+    if (!text.trim()) return null;
+    const modeMatch = text.match(/#\s*(?:grada|deploy-stack):domain-mode=([a-z-]+)/);
+    let mode = modeMatch && DOMAIN_MODES.includes(modeMatch[1]) ? modeMatch[1] : null;
+    if (!mode) {
+        if (text.includes('"cdn_alias_a"')) mode = 'route53';
+        else if (text.includes('"aws_acm_certificate_validation"')) mode = 'external-active';
+        else if (text.includes('"aws_acm_certificate"')) mode = 'external-pending';
+    }
+    const domainMatch = text.match(/domain_name\s*=\s*"([^"]+)"/);
+    const domain = domainMatch ? normalizeDomain(domainMatch[1]) : null;
+    let zoneId = null;
+    const zoneMarker = text.match(/#\s*(?:grada|deploy-stack):zone-id=([A-Za-z0-9/_-]+)/);
+    if (zoneMarker) zoneId = normalizeZoneId(zoneMarker[1]);
+    if (!zoneId) {
+        const zoneAttr = text.match(/zone_id\s*=\s*"([^"]+)"/);
+        if (zoneAttr) zoneId = normalizeZoneId(zoneAttr[1]);
+    }
+    return { domain: domain || null, mode, zoneId };
+}