grada-run 0.0.2 → 0.33.0

package/tests/parser.test.js

@@ -0,0 +1,160 @@
+import { describe, it, expect } from 'vitest';
+import { parseCliArgs } from '../src/core/parser.js';
+
+describe('CLI Argument Parser', () => {
+    it('safely extracts telemetry variations and prevents positional hijacking', () => {
+        // Simulating: npx deploy-stack secrets push .env --no-telemetry=true
+        const args = ['secrets', 'push', '.env', '--no-telemetry=true'];
+        const result = parseCliArgs(args);
+
+        expect(result.hasNoTelemetry).toBe(true);
+        expect(result.positionalArgs).toEqual(['secrets', 'push', '.env']);
+        expect(result.baseCommand).toBe('secrets push');
+    });
+
+    it('correctly parses headless boolean flags without assignments', () => {
+        // Simulating: npx deploy-stack --headless --needsDatabase
+        const args = ['--headless', '--needsDatabase'];
+        const result = parseCliArgs(args);
+
+        expect(result.isHeadless).toBe(true);
+        expect(result.headlessOptions.needsDatabase).toBe(true);
+    });
+
+    it('correctly maps headless assignment flags', () => {
+        // Simulating: npx deploy-stack --headless --framework=django --region=us-east-2
+        const args = ['--headless', '--framework=django', '--region=us-east-2'];
+        const result = parseCliArgs(args);
+
+        expect(result.headlessOptions.framework).toBe('django');
+        expect(result.headlessOptions.region).toBe('us-east-2');
+    });
+
+    it('survives non-array and mixed-element inputs without throwing', () => {
+        for (const bad of [null, undefined, 'string', 42, true, { port: 'string' }]) {
+            const result = parseCliArgs(bad);
+            expect(result.positionalArgs).toEqual([]);
+            expect(result.baseCommand).toBe('init');
+            expect(result.isHeadless).toBe(false);
+        }
+        const mixed = parseCliArgs(['--headless', 42, null, 'status']);
+        expect(mixed.isHeadless).toBe(true);
+        expect(mixed.positionalArgs).toEqual([42, null, 'status']);
+    });
+
+    it('extracts isPreconfigured and always populates initOptions', () => {
+        const headless = parseCliArgs(['--headless', '--preconfigured']);
+        expect(headless.isPreconfigured).toBe(true);
+        expect(headless.initOptions).toEqual({
+            with: [],
+            model: null,
+            domain: null,
+            zoneId: null,
+            fromEmail: null,
+            dbEngine: null,
+            target: null,
+            setupCiMigrate: false,
+            setupCiDrift: false,
+        });
+
+        const interactive = parseCliArgs(['init', '--with', 'db:redis']);
+        expect(interactive.isPreconfigured).toBe(false);
+        expect(interactive.initOptions.with).toEqual(['db:redis']);
+    });
+
+    it('accumulates repeatable and comma-separated --with with dedupe', () => {
+        const result = parseCliArgs([
+            '--headless',
+            '--with', 'db:redis, queue:sqs',
+            '--with=db:redis',
+            '--with=ai:bedrock,',
+            '--with', '--headless',
+        ]);
+        expect(result.initOptions.with).toEqual(['db:redis', 'queue:sqs', 'ai:bedrock']);
+    });
+
+    it('parses addon value flags in space and equals forms', () => {
+        const spaced = parseCliArgs(['--headless', '--model', 'claude-x', '--domain', 'example.com']);
+        expect(spaced.initOptions.model).toBe('claude-x');
+        expect(spaced.initOptions.domain).toBe('example.com');
+
+        const joined = parseCliArgs(['--zone-id=Z1', '--from-email=hi@example.com', '--setup-ci-migrate']);
+        expect(joined.initOptions.zoneId).toBe('Z1');
+        expect(joined.initOptions.fromEmail).toBe('hi@example.com');
+        expect(joined.initOptions.setupCiMigrate).toBe(true);
+        expect(parseCliArgs(['--setup-ci-drift']).initOptions.setupCiDrift).toBe(true);
+    });
+
+    it('treats valueless addon flags as absent', () => {
+        const result = parseCliArgs(['--headless', '--model', '--domain=', '--with']);
+        expect(result.initOptions.model).toBeNull();
+        expect(result.initOptions.domain).toBeNull();
+        expect(result.initOptions.with).toEqual([]);
+    });
+
+    it('parses --db-engine in space and equals forms', () => {
+        const spaced = parseCliArgs(['--headless', '--db-engine', 'mysql']);
+        expect(spaced.initOptions.dbEngine).toBe('mysql');
+
+        const joined = parseCliArgs(['--db-engine=aurora-postgresql']);
+        expect(joined.initOptions.dbEngine).toBe('aurora-postgresql');
+
+        const absent = parseCliArgs(['--headless']);
+        expect(absent.initOptions.dbEngine).toBeNull();
+    });
+
+    it('parses --target in space and equals forms', () => {
+        const spaced = parseCliArgs(['--headless', '--target', 'lambda']);
+        expect(spaced.initOptions.target).toBe('lambda');
+
+        const joined = parseCliArgs(['--target=ecs']);
+        expect(joined.initOptions.target).toBe('ecs');
+
+        const absent = parseCliArgs(['--headless']);
+        expect(absent.initOptions.target).toBeNull();
+    });
+
+    it('treats a valueless --target as absent', () => {
+        expect(parseCliArgs(['--headless', '--target']).initOptions.target).toBeNull();
+        expect(parseCliArgs(['--target=']).initOptions.target).toBeNull();
+    });
+
+    it('parses headless value flags in space and equals forms', () => {
+        const spaced = parseCliArgs(['--headless', '--target', 'lambda', '--framework', 'node', '--region', 'eu-west-1']);
+        expect(spaced.headlessOptions.framework).toBe('node');
+        expect(spaced.headlessOptions.region).toBe('eu-west-1');
+        expect(spaced.initOptions.target).toBe('lambda');
+
+        const joined = parseCliArgs(['--headless', '--framework=django', '--port=3000']);
+        expect(joined.headlessOptions.framework).toBe('django');
+        expect(joined.headlessOptions.port).toBe('3000');
+
+        const missing = parseCliArgs(['--headless']);
+        expect(missing.headlessOptions.framework).toBeNull();
+        expect(missing.headlessOptions.needsDatabase).toBeNull();
+    });
+
+    it('preserves bare-boolean headless flags without consuming neighbors', () => {
+        const bare = parseCliArgs(['--headless', '--needsDatabase', '--framework', 'node']);
+        expect(bare.headlessOptions.needsDatabase).toBe(true);
+        expect(bare.headlessOptions.framework).toBe('node');
+
+        expect(parseCliArgs(['--headless', '--needsDatabase=true']).headlessOptions.needsDatabase).toBe(true);
+        expect(parseCliArgs(['--headless', '--enablePrPreviews=false']).headlessOptions.enablePrPreviews).toBe(false);
+    });
+
+    it('filters consumed flag values out of positionalArgs and baseCommand', () => {
+        const init = parseCliArgs(['--headless', '--target', 'lambda', '--framework', 'node']);
+        expect(init.positionalArgs).toEqual([]);
+        expect(init.baseCommand).toBe('init');
+
+        const routed = parseCliArgs(['status', '--region', 'us-east-1']);
+        expect(routed.positionalArgs).toEqual(['status']);
+        expect(routed.baseCommand).toBe('status');
+
+        // Genuine positionals (mixed with flags) are untouched.
+        const secrets = parseCliArgs(['secrets', 'push', '.env', '--region', 'us-east-2']);
+        expect(secrets.positionalArgs).toEqual(['secrets', 'push', '.env']);
+        expect(secrets.baseCommand).toBe('secrets push');
+    });
+});

package/tests/rds.test.js

@@ -0,0 +1,244 @@
+import { describe, it, expect, vi } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import {
+    findDbInstance,
+    findDbCluster,
+    findDbTarget,
+    generateSnapshotId,
+    isValidSnapshotId,
+    resolveDbIdentifier,
+    resolveDbClusterIdentifier,
+} from '../src/utils/rds.js';
+
+const { MockDescribeDBInstancesCommand, MockDescribeDBClustersCommand } = vi.hoisted(() => {
+    const cmd = () => vi.fn(function (input) { Object.assign(this, input); });
+    return {
+        MockDescribeDBInstancesCommand: cmd(),
+        MockDescribeDBClustersCommand: cmd(),
+    };
+});
+
+vi.mock('@aws-sdk/client-rds', () => ({
+    RDSClient: vi.fn(function () { this.send = vi.fn(); }),
+    DescribeDBInstancesCommand: MockDescribeDBInstancesCommand,
+    DescribeDBClustersCommand: MockDescribeDBClustersCommand,
+}));
+
+function mockClient(handler) {
+    return { send: vi.fn(handler) };
+}
+
+describe('findDbInstance', () => {
+    it('returns the instance for an exact identifier match', async () => {
+        const instance = { DBInstanceIdentifier: 'myapp-db' };
+        const client = mockClient(() => Promise.resolve({ DBInstances: [instance] }));
+        await expect(findDbInstance(client, 'myapp-db')).resolves.toBe(instance);
+        const input = client.send.mock.calls[0][0];
+        expect(input.DBInstanceIdentifier).toBe('myapp-db');
+    });
+
+    it('returns null when no instances are returned', async () => {
+        const client = mockClient(() => Promise.resolve({ DBInstances: [] }));
+        await expect(findDbInstance(client, 'myapp-db')).resolves.toBeNull();
+    });
+
+    it.each(['DBInstanceNotFound', 'DBInstanceNotFoundFault'])('returns null on %s', async (name) => {
+        const err = new Error('missing');
+        err.name = name;
+        const client = mockClient(() => Promise.reject(err));
+        await expect(findDbInstance(client, 'myapp-db')).resolves.toBeNull();
+    });
+
+    it('rethrows unexpected errors', async () => {
+        const err = new Error('boom');
+        err.name = 'AccessDenied';
+        const client = mockClient(() => Promise.reject(err));
+        await expect(findDbInstance(client, 'myapp-db')).rejects.toBe(err);
+    });
+});
+
+describe('generateSnapshotId', () => {
+    it('formats the UTC timestamp suffix', () => {
+        const now = new Date(Date.UTC(2026, 4, 9, 7, 8, 9));
+        expect(generateSnapshotId('myapp-db', now)).toBe('myapp-db-manual-20260509-070809');
+    });
+
+    it('lowercases the identifier', () => {
+        const now = new Date(Date.UTC(2026, 0, 1, 0, 0, 0));
+        expect(generateSnapshotId('MyApp-DB', now)).toBe('myapp-db-manual-20260101-000000');
+    });
+
+    it('produces a valid snapshot id by default', () => {
+        expect(isValidSnapshotId(generateSnapshotId('myapp-db'))).toBe(true);
+    });
+});
+
+describe('isValidSnapshotId', () => {
+    it.each([
+        'a',
+        'snap1',
+        'myapp-db-manual-20260509-070809',
+        'A-valid-ID-123',
+        'x'.repeat(255),
+    ])('accepts %s', (id) => {
+        expect(isValidSnapshotId(id)).toBe(true);
+    });
+
+    it.each([
+        '',
+        '1abc',
+        '-abc',
+        'has space',
+        'has_underscore',
+        'has--double-hyphen',
+        'trailing-',
+        'x'.repeat(256),
+        undefined,
+        null,
+        123,
+    ])('rejects %s', (id) => {
+        expect(isValidSnapshotId(id)).toBe(false);
+    });
+});
+
+describe('resolveDbIdentifier', () => {
+    it('prefers an explicit --db-identifier override', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        expect(resolveDbIdentifier({ projectName: 'myapp', dbIdentifier: '  custom-db  ' }, dir)).toBe('custom-db');
+    });
+
+    it('resolves the project default with workspace suffixes', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        expect(resolveDbIdentifier({ projectName: 'myapp' }, dir)).toBe('myapp-db');
+        expect(resolveDbIdentifier({ projectName: 'myapp', workspace: 'pr-1' }, dir)).toBe('myapp-pr-1-db');
+    });
+
+    it('auto-detects the workspace from .terraform/environment', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        fs.mkdirSync(path.join(dir, '.terraform'), { recursive: true });
+        fs.writeFileSync(path.join(dir, '.terraform', 'environment'), 'pr-42\n');
+        expect(resolveDbIdentifier({ projectName: 'myapp' }, dir)).toBe('myapp-pr-42-db');
+    });
+
+    it('survives synthetic fuzzer inputs', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        for (const bad of [null, undefined, 'string', 42, true, { port: 'string' }]) {
+            expect(resolveDbIdentifier(bad, dir)).toBe(resolveDbIdentifier({}, dir));
+        }
+        expect(resolveDbIdentifier({ projectName: 'myapp' }, 42)).toBe(resolveDbIdentifier({ projectName: 'myapp' }));
+        expect(resolveDbIdentifier({ projectName: 'myapp', cwd: 42 }, dir)).toBe('myapp-db');
+    });
+});
+
+describe('resolveDbClusterIdentifier', () => {
+    it('prefers an explicit --db-identifier override', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        expect(resolveDbClusterIdentifier({ projectName: 'myapp', dbIdentifier: '  custom-db  ' }, dir)).toBe('custom-db');
+    });
+
+    it('resolves the cluster default with workspace suffixes', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'rds-id-'));
+        expect(resolveDbClusterIdentifier({ projectName: 'myapp' }, dir)).toBe('myapp-db-cluster');
+        expect(resolveDbClusterIdentifier({ projectName: 'myapp', workspace: 'pr-1' }, dir)).toBe('myapp-pr-1-db-cluster');
+    });
+});
+
+describe('findDbCluster', () => {
+    it('returns the cluster for an exact identifier match', async () => {
+        const cluster = { DBClusterIdentifier: 'myapp-db-cluster' };
+        const client = mockClient(() => Promise.resolve({ DBClusters: [cluster] }));
+        await expect(findDbCluster(client, 'myapp-db-cluster')).resolves.toBe(cluster);
+        const input = client.send.mock.calls[0][0];
+        expect(input.DBClusterIdentifier).toBe('myapp-db-cluster');
+    });
+
+    it.each(['DBClusterNotFound', 'DBClusterNotFoundFault'])('returns null on %s', async (name) => {
+        const err = new Error('missing');
+        err.name = name;
+        const client = mockClient(() => Promise.reject(err));
+        await expect(findDbCluster(client, 'myapp-db-cluster')).resolves.toBeNull();
+    });
+
+    it('rethrows unexpected errors', async () => {
+        const err = new Error('boom');
+        err.name = 'AccessDenied';
+        const client = mockClient(() => Promise.reject(err));
+        await expect(findDbCluster(client, 'myapp-db-cluster')).rejects.toBe(err);
+    });
+});
+
+describe('findDbTarget', () => {
+    const instance = {
+        DBInstanceIdentifier: 'myapp-db',
+        Engine: 'postgres',
+        Status: 'available',
+        Endpoint: { Address: 'myapp-db.abc.us-east-2.rds.amazonaws.com', Port: 5432 },
+        DBName: 'myapp',
+        MasterUserSecret: { SecretArn: 'arn:secret' },
+    };
+    const cluster = {
+        DBClusterIdentifier: 'myapp-db-cluster',
+        Engine: 'aurora-postgresql',
+        Status: 'available',
+        Endpoint: 'myapp-db-cluster.xyz.us-east-2.rds.amazonaws.com',
+        Port: 5432,
+        DatabaseName: 'myapp',
+        MasterUserSecret: { SecretArn: 'arn:secret' },
+    };
+
+    it('resolves an instance with a single API call', async () => {
+        const client = mockClient(() => Promise.resolve({ DBInstances: [instance] }));
+        const target = await findDbTarget(client, { dbIdentifier: 'myapp-db', dbClusterIdentifier: 'myapp-db-cluster' });
+        expect(target).toMatchObject({
+            kind: 'instance',
+            id: 'myapp-db',
+            engine: 'postgres',
+            status: 'available',
+            endpoint: 'myapp-db.abc.us-east-2.rds.amazonaws.com',
+            port: '5432',
+            dbName: 'myapp',
+            masterSecretArn: 'arn:secret',
+        });
+        expect(target.raw).toBe(instance);
+        expect(client.send).toHaveBeenCalledTimes(1);
+    });
+
+    it('falls back to the cluster identifier on instance miss', async () => {
+        const notFound = new Error('missing');
+        notFound.name = 'DBInstanceNotFound';
+        const client = mockClient((cmd) => {
+            if (cmd instanceof MockDescribeDBInstancesCommand) return Promise.reject(notFound);
+            return Promise.resolve({ DBClusters: [cluster] });
+        });
+        const target = await findDbTarget(client, { dbIdentifier: 'myapp-db', dbClusterIdentifier: 'myapp-db-cluster' });
+        expect(target).toMatchObject({
+            kind: 'cluster',
+            id: 'myapp-db-cluster',
+            engine: 'aurora-postgresql',
+            endpoint: 'myapp-db-cluster.xyz.us-east-2.rds.amazonaws.com',
+            port: '5432',
+            dbName: 'myapp',
+            masterSecretArn: 'arn:secret',
+        });
+        expect(target.raw).toBe(cluster);
+        expect(client.send.mock.calls[1][0].DBClusterIdentifier).toBe('myapp-db-cluster');
+    });
+
+    it('returns null when neither kind exists', async () => {
+        const client = mockClient((cmd) => {
+            const err = new Error('missing');
+            err.name = cmd instanceof MockDescribeDBInstancesCommand ? 'DBInstanceNotFound' : 'DBClusterNotFound';
+            return Promise.reject(err);
+        });
+        await expect(findDbTarget(client, { dbIdentifier: 'myapp-db', dbClusterIdentifier: 'myapp-db-cluster' })).resolves.toBeNull();
+    });
+
+    it('defaults the port by engine when the endpoint omits it', async () => {
+        const mysql = { ...instance, Engine: 'mysql', Endpoint: { Address: 'host' } };
+        const client = mockClient(() => Promise.resolve({ DBInstances: [mysql] }));
+        const target = await findDbTarget(client, { dbIdentifier: 'myapp-db' });
+        expect(target.port).toBe('3306');
+    });
+});

package/tests/resolvers.test.js

@@ -0,0 +1,279 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { createTmpDirTracker } from './helpers/tmpdir.js';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { readFileSafe, readTerraformProjectName, readTerraformRegion, resolveProjectName, resolveRegion, resolveLogGroup, resolveHeadless, resolveAppName, resolveCwd, resolveCluster, resolveService, resolveWorkspaceSuffix, detectComputeTargetFromMainTf, readTerraformComputeTarget } from '../src/utils/resolvers.js';
+
+const tmp = createTmpDirTracker();
+
+function makeTmp() {
+    return tmp.makeTmp('resolvers-test-');
+}
+
+beforeEach(() => {
+    tmp.reset();
+});
+
+afterEach(() => {
+    tmp.cleanup();
+});
+
+describe('readTerraformProjectName', () => {
+    it('returns null when terraform/main.tf is missing', () => {
+        expect(readTerraformProjectName(makeTmp())).toBeNull();
+    });
+
+    it('extracts the project name from local.app_name', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "myapp${local.env_suffix}"\n}\n'
+        );
+        expect(readTerraformProjectName(dir)).toBe('myapp');
+    });
+
+    it('falls back to the aws_ecr_repository app name', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'resource "aws_ecr_repository" "app" {\n  name = "fallback-app-repo"\n}\n'
+        );
+        expect(readTerraformProjectName(dir)).toBe('fallback-app');
+    });
+
+    it('returns null when neither pattern matches', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'terraform', 'main.tf'), 'provider "aws" {}\n');
+        expect(readTerraformProjectName(dir)).toBeNull();
+    });
+
+    it('prefers a plain app_name over the ECR repository heuristic', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "billing-app"\n}\nresource "aws_ecr_repository" "app" {\n  name = "other-repo"\n}\n'
+        );
+        expect(readTerraformProjectName(dir)).toBe('billing-app');
+    });
+
+    it('strips ${...} suffixes and trailing separators from a plain app_name', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "billing-app-${var.env}"\n}\n'
+        );
+        expect(readTerraformProjectName(dir)).toBe('billing-app');
+    });
+
+    it('ignores unrendered template placeholders', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "{{PROJECT_NAME}}"\n}\n'
+        );
+        expect(readTerraformProjectName(dir)).toBeNull();
+    });
+});
+
+describe('resolveProjectName', () => {
+    it('prefers an explicit --project-name option', () => {
+        const dir = makeTmp();
+        expect(resolveProjectName({ projectName: 'explicit' }, dir)).toBe('explicit');
+    });
+
+    it('reads the rendered terraform/main.tf before the directory basename', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "tf-app${local.env_suffix}"\n}\n'
+        );
+        expect(resolveProjectName({}, dir)).toBe('tf-app');
+    });
+
+    it('falls back to the directory basename', () => {
+        const dir = makeTmp();
+        expect(resolveProjectName({}, dir)).toBe(path.basename(dir));
+    });
+
+    it('still resolves the region from flags as before', () => {
+        expect(resolveRegion({ region: 'eu-west-1' }, makeTmp())).toBe('eu-west-1');
+    });
+
+    it('reads a plain app_name the same way for every consumer', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "billing-app"\n}\nresource "aws_ecr_repository" "app" {\n  name = "other-repo"\n}\n'
+        );
+        expect(resolveProjectName({}, dir)).toBe('billing-app');
+    });
+});
+
+describe('resolveLogGroup', () => {
+    it('prefers explicit flags, then env, then the project default', () => {
+        const dir = makeTmp();
+        expect(resolveLogGroup({ logGroup: '  /custom/group  ' }, dir)).toBe('/custom/group');
+        expect(resolveLogGroup({ logGroupName: '/named/group' }, dir)).toBe('/named/group');
+        process.env.ECS_LOG_GROUP = '/env/group';
+        try {
+            expect(resolveLogGroup({}, dir)).toBe('/env/group');
+        } finally {
+            delete process.env.ECS_LOG_GROUP;
+        }
+        expect(resolveLogGroup({ projectName: 'myapp' }, dir)).toBe('/ecs/myapp');
+    });
+});
+
+describe('detectComputeTargetFromMainTf', () => {
+    it('returns lambda when main.tf provisions the serverless function', () => {
+        expect(detectComputeTargetFromMainTf('resource "aws_lambda_function" "app" {\n}')).toBe('lambda');
+    });
+
+    it('returns ecs for ECS content, empty, and non-string inputs', () => {
+        expect(detectComputeTargetFromMainTf('resource "aws_ecs_service" "app" {}')).toBe('ecs');
+        expect(detectComputeTargetFromMainTf('')).toBe('ecs');
+        expect(detectComputeTargetFromMainTf(null)).toBe('ecs');
+        expect(detectComputeTargetFromMainTf(undefined)).toBe('ecs');
+    });
+});
+
+describe('readTerraformComputeTarget', () => {
+    it('reads lambda from a lambda project and defaults to ecs when missing', () => {
+        const lambdaDir = makeTmp();
+        fs.mkdirSync(path.join(lambdaDir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(lambdaDir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "myapp${local.env_suffix}"\n}\nresource "aws_lambda_function" "app" {}\n'
+        );
+        expect(readTerraformComputeTarget(lambdaDir)).toBe('lambda');
+        expect(readTerraformComputeTarget(makeTmp())).toBe('ecs');
+    });
+});
+
+describe('resolveLogGroup lambda target', () => {
+    it('defaults to the Lambda log group on lambda projects', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+        fs.writeFileSync(
+            path.join(dir, 'terraform', 'main.tf'),
+            'locals {\n  app_name = "myapp${local.env_suffix}"\n}\nresource "aws_lambda_function" "app" {}\n'
+        );
+        expect(resolveLogGroup({}, dir)).toBe('/aws/lambda/myapp-fn');
+        expect(resolveLogGroup({ logGroup: '/custom/group' }, dir)).toBe('/custom/group');
+    });
+});
+
+describe('resolveHeadless', () => {
+    const tty = { isTTY: true };
+    const noTty = {};
+
+    it('returns true for explicit headless flags and CI/test envs', () => {
+        expect(resolveHeadless({ isHeadless: true }, {}, tty, tty)).toBe(true);
+        expect(resolveHeadless({ headless: true }, {}, tty, tty)).toBe(true);
+        expect(resolveHeadless({}, { CI: 'true' }, tty, tty)).toBe(true);
+        expect(resolveHeadless({}, { VITEST: 'true' }, tty, tty)).toBe(true);
+        expect(resolveHeadless({}, { NODE_ENV: 'test' }, tty, tty)).toBe(true);
+    });
+
+    it('returns true when stdio is not a TTY', () => {
+        expect(resolveHeadless({}, {}, noTty, tty)).toBe(true);
+        expect(resolveHeadless({}, {}, tty, noTty)).toBe(true);
+        expect(resolveHeadless({}, {}, undefined, undefined)).toBe(true);
+    });
+
+    it('returns false for real interactive terminals', () => {
+        expect(resolveHeadless({}, {}, tty, tty)).toBe(false);
+    });
+
+    it('honors an explicit false override for simulated prompts', () => {
+        expect(resolveHeadless({ isHeadless: false }, { CI: 'true', VITEST: 'true' }, noTty, noTty)).toBe(false);
+        expect(resolveHeadless({ headless: false }, { NODE_ENV: 'test' }, noTty, noTty)).toBe(false);
+    });
+});
+
+describe('resolveAppName', () => {
+    it('combines the project name with the workspace suffix', () => {
+        const dir = makeTmp();
+        expect(resolveAppName('myapp', undefined, dir)).toBe('myapp');
+        expect(resolveAppName('myapp', 'pr-7', dir)).toBe('myapp-pr-7');
+        expect(resolveAppName('myapp', 'default', dir)).toBe('myapp');
+    });
+
+    it('auto-detects the workspace from .terraform/environment', () => {
+        const dir = makeTmp();
+        fs.mkdirSync(path.join(dir, '.terraform'), { recursive: true });
+        fs.writeFileSync(path.join(dir, '.terraform', 'environment'), 'pr-42\n');
+        expect(resolveAppName('myapp', undefined, dir)).toBe('myapp-pr-42');
+    });
+});
+
+describe('resolveCwd', () => {
+    it('prefers an explicit string cwd option', () => {
+        expect(resolveCwd({ cwd: '/tmp/x' })).toBe('/tmp/x');
+    });
+
+    it('falls back to the process cwd for missing or non-string values', () => {
+        expect(resolveCwd({})).toBe(process.cwd());
+        expect(resolveCwd({ cwd: 42 })).toBe(process.cwd());
+        expect(resolveCwd({ cwd: '' })).toBe(process.cwd());
+        expect(resolveCwd(null)).toBe(process.cwd());
+    });
+
+    it('honors a usable positional fallback before the process cwd', () => {
+        const dir = makeTmp();
+        expect(resolveCwd({}, dir)).toBe(dir);
+        expect(resolveCwd({ cwd: '/tmp/x' }, dir)).toBe('/tmp/x');
+        expect(resolveCwd({ cwd: 42 }, dir)).toBe(dir);
+        expect(resolveCwd(null, dir)).toBe(dir);
+        expect(resolveCwd({}, 42)).toBe(process.cwd());
+    });
+});
+
+describe('resolvers: fuzzer hardening', () => {
+    const BAD_OPTIONS = [null, undefined, 'string', 42, true, { port: 'string' }];
+
+    it.each(BAD_OPTIONS)('resolveProjectName(%s) behaves like {}', (bad) => {
+        expect(resolveProjectName(bad)).toBe(resolveProjectName({}));
+    });
+
+    it.each(BAD_OPTIONS)('resolveRegion/resolveCluster/resolveService/resolveLogGroup(%s) behave like {}', (bad) => {
+        expect(resolveRegion(bad)).toBe(resolveRegion({}));
+        expect(resolveCluster(bad)).toBe(resolveCluster({}));
+        expect(resolveService(bad)).toBe(resolveService({}));
+        expect(resolveLogGroup(bad)).toBe(resolveLogGroup({}));
+    });
+
+    it('survives non-string cwd positions', () => {
+        const dir = makeTmp();
+        expect(resolveProjectName({}, 42)).toBe(resolveProjectName({}));
+        expect(resolveProjectName({ cwd: 42 }, dir)).toBe(resolveProjectName({}, dir));
+        expect(resolveRegion({}, 42)).toBe(resolveRegion({}));
+        expect(resolveWorkspaceSuffix({}, 42)).toBe(resolveWorkspaceSuffix({}));
+        expect(resolveWorkspaceSuffix({ cwd: 42 }, dir)).toBe('');
+        expect(readTerraformRegion(42)).toBe(readTerraformRegion());
+        expect(readTerraformProjectName(42)).toBe(readTerraformProjectName());
+    });
+
+    it('resolveHeadless and resolveAppName coerce synthetic inputs', () => {
+        const dir = makeTmp();
+        expect(typeof resolveHeadless(null)).toBe('boolean');
+        expect(typeof resolveHeadless('string')).toBe('boolean');
+        expect(resolveAppName(42, 42, dir)).toBe('42');
+        expect(resolveAppName(null, null, dir)).toBe('null');
+    });
+
+    it('readFileSafe returns null for unusable paths', () => {
+        expect(readFileSafe(42)).toBeNull();
+        expect(readFileSafe(null)).toBeNull();
+        expect(readFileSafe({})).toBeNull();
+    });
+});