@fjall/components-infrastructure 2.27.0 → 2.30.0

package/dist/lib/resources/aws/cdn/responseHeadersPolicy.js

@@ -0,0 +1,92 @@
+import { Duration } from "aws-cdk-lib";
+import { ResponseHeadersPolicy as CdkResponseHeadersPolicy, HeadersFrameOption, HeadersReferrerPolicy } from "aws-cdk-lib/aws-cloudfront";
+const REFERRER_POLICY_MAP = {
+    "no-referrer": HeadersReferrerPolicy.NO_REFERRER,
+    "no-referrer-when-downgrade": HeadersReferrerPolicy.NO_REFERRER_WHEN_DOWNGRADE,
+    origin: HeadersReferrerPolicy.ORIGIN,
+    "origin-when-cross-origin": HeadersReferrerPolicy.ORIGIN_WHEN_CROSS_ORIGIN,
+    "same-origin": HeadersReferrerPolicy.SAME_ORIGIN,
+    "strict-origin": HeadersReferrerPolicy.STRICT_ORIGIN,
+    "strict-origin-when-cross-origin": HeadersReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+    "unsafe-url": HeadersReferrerPolicy.UNSAFE_URL
+};
+const DEFAULT_HSTS_MAX_AGE_DAYS = 730;
+const DEFAULT_COMMENT = "Fjall security headers policy";
+/**
+ * Fjall wrapper for `aws-cdk-lib/aws-cloudfront.ResponseHeadersPolicy`.
+ *
+ * Wrapped on the description + SOC2-defaults trigger (NOT taggability — the
+ * resource is not taggable): it owns Fjall's uniform security-header defaults
+ * so every consumer inherits the same posture in one edit. Per
+ * `.claude/rules/generator-standards.md § Wrapper Routing Discipline`,
+ * `lib/{config,patterns}/` instantiate this class, never the raw L2.
+ *
+ * Defaults (all `override:true`): HSTS 730d+includeSubdomains+preload,
+ * X-Content-Type-Options: nosniff, X-Frame-Options: DENY,
+ * Referrer-Policy: strict-origin-when-cross-origin. CSP is opt-in only (§5.5).
+ */
+export class SecurityHeadersPolicy extends CdkResponseHeadersPolicy {
+    constructor(scope, id, props) {
+        const securityHeadersBehavior = SecurityHeadersPolicy.buildSecurityHeaders(props);
+        const customHeaders = SecurityHeadersPolicy.buildCustomHeaders(props.customHeaders);
+        super(scope, id, {
+            responseHeadersPolicyName: props.policyName,
+            comment: props.comment ?? DEFAULT_COMMENT,
+            securityHeadersBehavior,
+            ...(customHeaders.length > 0 && {
+                customHeadersBehavior: { customHeaders }
+            })
+        });
+    }
+    static buildSecurityHeaders(props) {
+        const behaviour = {};
+        if (props.hsts !== false) {
+            const hsts = props.hsts ?? {};
+            behaviour.strictTransportSecurity = {
+                accessControlMaxAge: Duration.days(hsts.maxAgeDays ?? DEFAULT_HSTS_MAX_AGE_DAYS),
+                includeSubdomains: hsts.includeSubdomains ?? true,
+                preload: hsts.preload ?? true,
+                override: true
+            };
+        }
+        if (props.contentTypeOptions !== false) {
+            behaviour.contentTypeOptions = { override: true };
+        }
+        if (props.frameOptions !== false) {
+            behaviour.frameOptions = {
+                frameOption: props.frameOptions === "SAMEORIGIN"
+                    ? HeadersFrameOption.SAMEORIGIN
+                    : HeadersFrameOption.DENY,
+                override: true
+            };
+        }
+        if (props.referrerPolicy !== false) {
+            behaviour.referrerPolicy = {
+                referrerPolicy: REFERRER_POLICY_MAP[props.referrerPolicy ?? "strict-origin-when-cross-origin"],
+                override: true
+            };
+        }
+        // CSP is opt-in — only emitted when a policy string is supplied (§5.5).
+        if (props.contentSecurityPolicy !== undefined) {
+            behaviour.contentSecurityPolicy = {
+                contentSecurityPolicy: props.contentSecurityPolicy,
+                override: true
+            };
+        }
+        return behaviour;
+    }
+    static buildCustomHeaders(customHeaders) {
+        if (customHeaders === undefined) {
+            return [];
+        }
+        return Object.entries(customHeaders).map(([header, value]) => ({
+            header,
+            value,
+            override: true
+        }));
+    }
+    /** The underlying policy, for wiring into a distribution behaviour. */
+    getPolicy() {
+        return this;
+    }
+}

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -32,6 +32,13 @@ export interface LambdaFunctionProps {
     vpc?: IVpc;
     timeout?: number;
     memorySize?: number;
+    /**
+     * Cap on concurrent executions. Set this on any Lambda reachable without
+     * authentication (a public Function URL): it bounds both the function's own
+     * spend and the share of account-wide concurrency it can take from every
+     * other function.
+     */
+    reservedConcurrentExecutions?: number;
     /** Ephemeral storage size in MiB */
     ephemeralStorageSize?: number;
     /**

package/dist/lib/resources/aws/database/rdsHelpers.js

@@ -82,7 +82,10 @@ export function warnIfSnapshotUsernameAssumed(params) {
  * warning surfaces this to anyone opting in.
  */
 export function addMultiUserSecretRotation(params) {
-    const rotationPeriod = params.rotationConfig.automaticallyAfter ?? Duration.days(30);
+    const rotationPeriod = params.rotationConfig.automaticallyAfter ??
+        (params.rotationConfig.automaticallyAfterDays !== undefined
+            ? Duration.days(params.rotationConfig.automaticallyAfterDays)
+            : Duration.days(30));
     const masterSecret = new Secret(params.scope, `${params.databaseName}MasterSecret`, {
         secretName: ResourceNaming.masterSecretName(params.constructId)
     });

package/dist/lib/resources/aws/networking/domainCertificate.d.ts

@@ -9,6 +9,13 @@ export interface DomainCertificateProps {
     readonly transparencyLogging?: boolean;
     readonly costAllocationEnvironment?: string;
     readonly costAllocationDomain?: string;
+    /**
+     * Publish the `${domain}-certificate-arn` CloudFormation export. Default true.
+     * Set false when the cert is consumed in-stack (single-stack patterns) to
+     * avoid an export collision with a managed-domain/apex stack that also owns
+     * the domain's exports.
+     */
+    readonly exportCertificateArn?: boolean;
 }
 export declare class DomainCertificate extends Construct {
     readonly certificate: ICertificate;

package/dist/lib/resources/aws/networking/domainCertificate.js

@@ -26,12 +26,14 @@ export class DomainCertificate extends Construct {
             domain: props.costAllocationDomain ?? props.domainName,
             environment: props.costAllocationEnvironment
         });
-        const safeKey = toPascalCase(props.domainName.split(".").join(""));
-        const exports = getDomainExportNames(props.domainName);
-        new CfnOutput(this, `${safeKey}CertificateArn`, {
-            key: `${safeKey}CertificateArn`,
-            value: this.certificateArn,
-            exportName: exports.certificateArn
-        });
+        if (props.exportCertificateArn !== false) {
+            const safeKey = toPascalCase(props.domainName.split(".").join(""));
+            const exports = getDomainExportNames(props.domainName);
+            new CfnOutput(this, `${safeKey}CertificateArn`, {
+                key: `${safeKey}CertificateArn`,
+                value: this.certificateArn,
+                exportName: exports.certificateArn
+            });
+        }
     }
 }

package/dist/lib/utils/databaseTypes.d.ts

@@ -45,6 +45,12 @@ export interface CredentialsConfig {
 }
 export interface SecretRotationConfig {
     automaticallyAfter?: Duration;
+    /**
+     * Rotation period in whole days — the JSON-friendly form the generator
+     * scaffolds (`secretRotation: { automaticallyAfterDays: 30 }`). Ignored
+     * when `automaticallyAfter` is also set. Default: 30 days.
+     */
+    automaticallyAfterDays?: number;
 }
 /**
  * Resolve the opt-in rotation gate once at the construct boundary. Returns

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.27.0",
+  "version": "2.30.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -34,7 +34,8 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
     "test": "vitest run",
@@ -52,6 +53,7 @@
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1045.0",
     "@aws-sdk/client-iam": "^3.1038.0",
     "@aws-sdk/client-identitystore": "^3.1038.0",
+    "@aws-sdk/client-sesv2": "^3.1087.0",
     "@peculiar/x509": "2.0.0",
     "@types/aws-lambda": "^8.10.161",
     "@types/node": "^26.0.0",
@@ -65,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.27.0",
-    "@fjall/util": "^2.27.0",
+    "@fjall/generator": "^2.30.0",
+    "@fjall/util": "^2.30.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -80,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
+  "gitHead": "ec35b16db566dfa5feb714c16f132c55b4663c86"
 }