@fjall/components-infrastructure 2.30.0 → 2.31.1

package/dist/lib/config/aws/oidcConnector.js

@@ -1,5 +1,5 @@
 import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, FJALL_OIDC_AUDIENCE, FJALL_OIDC_ISSUER_DOMAIN, FJALL_OIDC_PLACEHOLDER_THUMBPRINT, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
-import { CfnOutput, Duration, Stack } from "aws-cdk-lib";
+import { Aws, CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
@@ -80,15 +80,23 @@ export class OidcConnector extends Construct {
             resourceType: "Custom::FjallOidcProvider",
             properties: { IssuerUrl: issuerUrl },
             inlinePolicy: [
+                // iam:ListOpenIDConnectProviders supports no resource-level
+                // permission — the star grants provider-list metadata only.
+                new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: ["iam:ListOpenIDConnectProviders"],
+                    resources: ["*"]
+                }),
                 new iam.PolicyStatement({
                     effect: iam.Effect.ALLOW,
                     actions: [
-                        "iam:ListOpenIDConnectProviders",
                         "iam:GetOpenIDConnectProvider",
                         "iam:CreateOpenIDConnectProvider",
                         "iam:AddClientIDToOpenIDConnectProvider"
                     ],
-                    resources: ["*"]
+                    resources: [
+                        `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:oidc-provider/${issuerDomain}`
+                    ]
                 })
             ],
             inlineCode: OIDC_PROVIDER_HANDLER

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -3,11 +3,20 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)

package/dist/lib/patterns/aws/compute.d.ts

@@ -4,9 +4,9 @@ import { type SecretImport } from "../../resources/aws/secrets/index.js";
 import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compute, type AnyCompute, isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import type App from "../../app.js";
 import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
+import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
 import { Ec2Compute, type Ec2ComputeProps, type SshConfig } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/compute.js

@@ -3,18 +3,19 @@ import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { buildParameterPath } from "@fjall/util";
 import { isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import { warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
+import { COMPUTE_WARN_GROUPS, CONTAINER_LAMBDA_ONLY_PROPS, CODE_LAMBDA_ONLY_PROPS } from "./computePropApplicability.js";
 import { applyInferredPublicBuildArgs } from "./computeBuildArgInference.js";
 import { DEFAULT_ECS_FALLBACK_IMAGE, DEFAULT_EC2_INSTANCE_TYPE } from "../../resources/aws/compute/ecsConstants.js";
 // Import and re-export from per-pattern files
 import { EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
+import { LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
 import { Ec2Compute } from "./computeEc2.js";
 // Re-export everything from per-pattern files
 export { 
 // ECS
 EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig, 
 // Lambda
-LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, 
+LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, 
 // EC2
 Ec2Compute };
 export const COMPUTE_TYPE_CONFIG = {
@@ -90,12 +91,20 @@ export function getComputeTypeConfig(type) {
  * TypeScript's compile-time checks may not apply.
  */
 function validateComputeProps(props) {
-    // ECS-specific options on non-ECS compute
-    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config", "services", "cluster"], "ecs", "ECS compute");
-    // Lambda-specific options on non-Lambda compute
-    warnIfPropertiesIgnored(props, ["functionUrl", "handler", "runtime"], "lambda", "Lambda compute");
-    // EC2-specific options on non-EC2 compute
-    warnIfPropertiesIgnored(props, ["ssh", "userData", "machineImage"], "ec2", "EC2 compute");
+    for (const group of COMPUTE_WARN_GROUPS) {
+        warnIfPropertiesIgnored(props, group.properties, group.applicableTypes, group.typeName);
+    }
+    // capacityProvider/ec2Config are EcsServiceConfig-level keys, not top-level
+    // EcsComputeProps, so the guard Record in computePropApplicability.ts would
+    // reject them — hand-curated misuse hints stay outside it.
+    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config"], "ecs", "ECS compute");
+    if (props.type === "lambda") {
+        // warnIfPropertyIgnored reads only `.type` + presence, so a
+        // deployment-keyed view reuses the same machinery for the second axis.
+        const byDeployment = { ...props, type: props.deployment };
+        warnIfPropertiesIgnored(byDeployment, CONTAINER_LAMBDA_ONLY_PROPS, "container", "container-deployment Lambda", "deployment");
+        warnIfPropertiesIgnored(byDeployment, CODE_LAMBDA_ONLY_PROPS, "code", "code-deployment Lambda", "deployment");
+    }
     // ECS-specific validation - type narrowing handled by discriminated union
     if (props.type === "ecs") {
         validateEcsProps(props);
@@ -221,6 +230,10 @@ export class ComputeFactory {
                         ...computeProps,
                         appName: app.getName()
                     };
+                    // `ecrRepository` is already defaulted to the app's shared default
+                    // container registry above (line ~323) when omitted — the same
+                    // repo ECS services push into — so a container Lambda always has
+                    // one by this point, whether or not `docker` is set.
                     // Always register Lambda with manifest collector for CLI discovery
                     // This ensures all Lambdas are discoverable for secrets management,
                     // even those that don't currently have secrets configured
@@ -242,6 +255,11 @@ export class ComputeFactory {
                     if (lambdaImportedSecretNames.size > 0) {
                         manifestLambda.importedSecretNames = Array.from(lambdaImportedSecretNames);
                     }
+                    if (lambdaComputeProps.deployment === "container" &&
+                        lambdaComputeProps.docker !== undefined) {
+                        manifestLambda.docker = lambdaComputeProps.docker;
+                        manifestLambda.imageKey = lambdaImageKey(lambdaComputeProps, id);
+                    }
                     collector.addLambda(manifestLambda);
                     return new LambdaCompute(scope, id, lambdaComputeProps);
                 }

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -8,6 +8,7 @@ import { type ILambdaCompute } from "./interfaces/compute.js";
 import { type ConnectionSpec } from "./interfaces/connector.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
 import { type SecretImport } from "../../resources/aws/secrets/index.js";
+import { type DockerBuild } from "@fjall/util/manifest/schemas";
 export { Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "aws-cdk-lib/aws-lambda";
 /**
  * Lambda function URL configuration.
@@ -114,17 +115,47 @@ interface BaseLambdaProps {
  * automatically set to FROM_IMAGE.
  *
  * @example
+ * // Bring your own image (built/pushed out of band)
  * app.addCompute(ComputeFactory.build("ImageLambda", {
  *   type: "lambda",
  *   deployment: "container",
  *   ecrRepository: app.getDefaultContainerRegistry()
  * }));
+ *
+ * @example
+ * // fjall builds and pushes the image on every `fjall deploy`
+ * app.addCompute(ComputeFactory.build("ImageLambda", {
+ *   type: "lambda",
+ *   deployment: "container",
+ *   docker: { path: "lambda.Dockerfile" }
+ * }));
  */
 export interface ContainerLambdaProps extends BaseLambdaProps {
     /** Container-based deployment using ECR image */
     deployment: "container";
-    /** ECR repository containing the Lambda container image */
-    ecrRepository: Repository | RepositoryImage;
+    /**
+     * ECR repository containing the Lambda container image. Optional when
+     * `docker` is set — defaults to the app's shared default container
+     * registry (the same repo ECS services push into).
+     */
+    ecrRepository?: Repository | RepositoryImage;
+    /**
+     * When set, `fjall deploy` builds and pushes this Dockerfile into the app's
+     * shared default container registry, then wires the function to the
+     * resulting content-hash-tagged image — the same mechanism ECS services
+     * already use. Omit to keep managing the image out of band (the previous
+     * behaviour: the function tracks a moving `:latest` tag in `ecrRepository`).
+     */
+    docker?: DockerBuild;
+    /**
+     * Shared build/tag key for Lambda functions that intentionally run the
+     * same container image (e.g. several handlers packaged from one
+     * Dockerfile). Functions sharing one `image` value build once and share
+     * one content-hash tag. Defaults to this Lambda's own construct id, so
+     * omitting it is safe when no sharing is intended. Only meaningful when
+     * `docker` is set.
+     */
+    image?: string;
 }
 /**
  * Code-based Lambda using inline code or S3.
@@ -154,7 +185,9 @@ export interface CodeLambdaProps extends BaseLambdaProps {
  * Lambda compute configuration.
  *
  * Discriminated union ensuring type-safe Lambda configuration:
- * - `deployment: "container"` requires `ecrRepository`
+ * - `deployment: "container"` takes `ecrRepository` (bring-your-own image)
+ *   and/or `docker` (fjall builds and pushes; `ecrRepository` then defaults
+ *   to the app's shared default container registry)
  * - `deployment: "code"` requires `code` and allows `handler`/`runtime`
  *
  * @example
@@ -174,11 +207,27 @@ export interface ResolvedLambdaDeployment {
     handler: string;
     runtime: Runtime;
 }
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export declare function lambdaImageKey(props: {
+    image?: string;
+}, id: string): string;
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
+ *
+ * `scope`/`id` are only used on the container-with-`docker` path, to create
+ * (or reuse) the per-key `CfnParameter` that `fjall deploy` overrides with
+ * the content-hash tag after building and pushing the image.
  */
-export declare function resolveLambdaDeployment(props: LambdaComputeProps): ResolvedLambdaDeployment;
+export declare function resolveLambdaDeployment(scope: Construct, id: string, props: LambdaComputeProps): ResolvedLambdaDeployment;
 /**
  * Lambda compute wrapper implementing ILambdaCompute.
  * Provides type-safe access to Lambda-specific resources.

package/dist/lib/patterns/aws/computeLambda.js

@@ -4,18 +4,61 @@ import { Repository } from "aws-cdk-lib/aws-ecr";
 import { Construct } from "constructs";
 import { processConnections } from "../../utils/connections.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
+import { getOrCreateImageTagParameter } from "../../resources/aws/compute/imageTagParameter.js";
 import { COMPUTE_DEFAULTS } from "./compute.js";
+import { evaluateBakeGuard } from "@fjall/util/docker";
+import { toKebab } from "@fjall/util";
 // Re-export Lambda types from CDK for user convenience
 export { Architecture, HttpMethod, InvokeMode } from "aws-cdk-lib/aws-lambda";
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export function lambdaImageKey(props, id) {
+    return props.image !== undefined && props.image !== "" ? props.image : id;
+}
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
+ *
+ * `scope`/`id` are only used on the container-with-`docker` path, to create
+ * (or reuse) the per-key `CfnParameter` that `fjall deploy` overrides with
+ * the content-hash tag after building and pushing the image.
  */
-export function resolveLambdaDeployment(props) {
+export function resolveLambdaDeployment(scope, id, props) {
     if (props.deployment === "container") {
+        if (!props.ecrRepository) {
+            throw new Error(`Lambda '${id}': ecrRepository is required unless \`docker\` is set ` +
+                "(ComputeFactory fills it in automatically from the app's default container registry when docker is present).");
+        }
         if (!(props.ecrRepository instanceof Repository)) {
             throw new Error("ecrRepository must be a Repository instance for Lambda compute type");
         }
+        if (props.docker !== undefined) {
+            const appPrefix = props.appName !== undefined ? toKebab(props.appName) : "";
+            const findings = evaluateBakeGuard(props.docker.buildArgs, appPrefix).findings;
+            if (findings.length > 0) {
+                throw new Error(`Lambda '${id}': ${findings.map((f) => f.message).join(" ")}`);
+            }
+            const tagKey = lambdaImageKey(props, id);
+            const param = getOrCreateImageTagParameter(scope, tagKey, {
+                kind: "lambda-image",
+                declaredBy: id,
+                docker: props.docker
+            });
+            return {
+                code: Code.fromEcrImage(props.ecrRepository, {
+                    tagOrDigest: param.valueAsString
+                }),
+                handler: Handler.FROM_IMAGE,
+                runtime: Runtime.FROM_IMAGE
+            };
+        }
         return {
             code: Code.fromEcrImage(props.ecrRepository, {
                 tagOrDigest: COMPUTE_DEFAULTS.ECS.IMAGE_TAG
@@ -40,7 +83,7 @@ export class LambdaCompute extends Construct {
     lambdaFunction;
     constructor(scope, id, props) {
         super(scope, id);
-        const { code, handler, runtime } = resolveLambdaDeployment(props);
+        const { code, handler, runtime } = resolveLambdaDeployment(scope, id, props);
         // Convert presence-based functionUrl config to legacy boolean format
         const functionUrlConfig = props.functionUrl;
         const enableFunctionUrl = functionUrlConfig !== undefined && functionUrlConfig !== false;

package/dist/lib/patterns/aws/computePropApplicability.d.ts

@@ -0,0 +1,20 @@
+import type { ComputeType } from "./interfaces/compute.js";
+import type { EcsComputeProps } from "./computeEcsTypes.js";
+import type { LambdaComputeProps } from "./computeLambda.js";
+import type { Ec2ComputeProps } from "./computeEc2.js";
+type KeysOfUnion<T> = T extends unknown ? keyof T : never;
+type AllComputePropKeys = keyof EcsComputeProps | KeysOfUnion<LambdaComputeProps> | keyof Ec2ComputeProps;
+export interface ComputeWarnGroup {
+    properties: string[];
+    applicableTypes: ComputeType[];
+    typeName: string;
+}
+export declare const COMPUTE_WARN_GROUPS: readonly ComputeWarnGroup[];
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export declare const ALL_COMPUTE_PROP_KEYS: AllComputePropKeys[];
+export declare const CONTAINER_LAMBDA_ONLY_PROPS: string[];
+export declare const CODE_LAMBDA_ONLY_PROPS: string[];
+export {};

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -0,0 +1,87 @@
+/**
+ * Compile-time lockstep guard for `validateComputeProps`'s ignored-prop
+ * warnings. The Record over the full top-level key union rejects BOTH a
+ * missing key (a new prop added to any compute props interface fails TS2741
+ * here until classified) and a stale extra key (a removed/renamed prop fails
+ * TS2353). `"all"` means the prop is legitimate on every compute type and
+ * never warns.
+ */
+const COMPUTE_PROP_APPLICABILITY = {
+    type: "all",
+    vpc: "all",
+    appName: ["ecs", "lambda"],
+    docker: ["ecs", "lambda"],
+    ecrRepository: ["ecs", "lambda"],
+    cluster: ["ecs"],
+    services: ["ecs"],
+    alertsTopic: ["ecs"],
+    applicationId: ["ecs"],
+    deployment: ["lambda"],
+    functionUrl: ["lambda"],
+    handler: ["lambda"],
+    runtime: ["lambda"],
+    code: ["lambda"],
+    image: ["lambda"],
+    timeout: ["lambda"],
+    memorySize: ["lambda"],
+    ephemeralStorageSize: ["lambda"],
+    architecture: ["lambda"],
+    description: ["lambda"],
+    roleDescription: ["lambda"],
+    inlinePolicy: ["lambda"],
+    environment: ["lambda"],
+    secrets: ["lambda"],
+    ssmSecretsPath: ["lambda"],
+    secretsImport: ["lambda"],
+    connections: ["lambda"],
+    instanceType: ["ec2"],
+    ssh: ["ec2"],
+    userData: ["ec2"],
+    machineImage: ["ec2"],
+    minCapacity: ["ec2"],
+    maxCapacity: ["ec2"],
+    spotCapacityPercentage: ["ec2"]
+};
+const TYPE_LABELS = {
+    ecs: "ECS",
+    lambda: "Lambda",
+    ec2: "EC2"
+};
+export const COMPUTE_WARN_GROUPS = (() => {
+    const groups = new Map();
+    for (const [prop, applicability] of Object.entries(COMPUTE_PROP_APPLICABILITY)) {
+        if (applicability === "all")
+            continue;
+        const key = applicability.join("+");
+        const existing = groups.get(key);
+        if (existing !== undefined) {
+            existing.properties.push(prop);
+        }
+        else {
+            groups.set(key, {
+                properties: [prop],
+                applicableTypes: [...applicability],
+                typeName: applicability.map((t) => TYPE_LABELS[t]).join(" or ") + " compute"
+            });
+        }
+    }
+    return [...groups.values()];
+})();
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export const ALL_COMPUTE_PROP_KEYS = Object.keys(COMPUTE_PROP_APPLICABILITY);
+const LAMBDA_DEPLOYMENT_APPLICABILITY = {
+    ecrRepository: "container",
+    docker: "container",
+    image: "container",
+    code: "code",
+    handler: "code",
+    runtime: "code"
+};
+const deploymentProps = (d) => Object.entries(LAMBDA_DEPLOYMENT_APPLICABILITY)
+    .filter(([, v]) => v === d)
+    .map(([k]) => k);
+export const CONTAINER_LAMBDA_ONLY_PROPS = deploymentProps("container");
+export const CODE_LAMBDA_ONLY_PROPS = deploymentProps("code");

package/dist/lib/resources/aws/compute/ecsImages.js

@@ -1,34 +1,17 @@
-import { CfnParameter, Stack } from "aws-cdk-lib";
 import { ContainerImage } from "aws-cdk-lib/aws-ecs";
 import { Repository } from "aws-cdk-lib/aws-ecr";
-import { imageTagParameterName } from "@fjall/util";
 import { DEFAULT_ECS_FALLBACK_IMAGE } from "./ecsConstants.js";
-function buildImageTagDescription(serviceName) {
-    return `Image tag for ECS service ${serviceName}. Set by fjall deploy to the content-hash tag.`;
-}
-function getOrCreateImageTagParameter(ctx, serviceName) {
-    const stack = Stack.of(ctx.scope);
-    const paramLogicalId = imageTagParameterName(serviceName);
-    const description = buildImageTagDescription(serviceName);
-    const existing = stack.node.tryFindChild(paramLogicalId);
-    if (existing instanceof CfnParameter) {
-        if (existing.description !== description) {
-            throw new Error(`CfnParameter logical-ID collision: "${paramLogicalId}" is already registered for a different service. ` +
-                `Distinct service names cannot share a PascalCase identifier — rename one of the conflicting services.`);
-        }
-        return existing;
-    }
-    return new CfnParameter(stack, paramLogicalId, {
-        type: "String",
-        default: "latest",
-        description
-    });
-}
+import { getOrCreateImageTagParameter } from "./imageTagParameter.js";
 export function getContainerImage(ctx, serviceName, containerConfig, serviceProps) {
     const imageSource = containerConfig.image || serviceProps.image || ctx.props.ecrRepository;
     if (!imageSource) {
         return ContainerImage.fromRegistry(DEFAULT_ECS_FALLBACK_IMAGE);
     }
+    const entity = {
+        kind: "ecs-service",
+        declaredBy: serviceName,
+        docker: serviceProps.docker
+    };
     if (typeof imageSource === "string") {
         const isFullRegistryUrl = /^(docker\.io|registry\.hub\.docker\.com|ghcr\.io)\//i.test(imageSource) ||
             imageSource.startsWith("public.ecr.aws/") ||
@@ -36,11 +19,11 @@ export function getContainerImage(ctx, serviceName, containerConfig, serviceProp
         if (isFullRegistryUrl) {
             return ContainerImage.fromRegistry(imageSource);
         }
-        const param = getOrCreateImageTagParameter(ctx, serviceName);
+        const param = getOrCreateImageTagParameter(ctx.scope, serviceName, entity);
         return ContainerImage.fromEcrRepository(Repository.fromRepositoryName(ctx.scope, `${serviceName}${containerConfig.name}EcrRepo`, imageSource), param.valueAsString);
     }
     if (imageSource instanceof Repository) {
-        const param = getOrCreateImageTagParameter(ctx, serviceName);
+        const param = getOrCreateImageTagParameter(ctx.scope, serviceName, entity);
         return ContainerImage.fromEcrRepository(imageSource, param.valueAsString);
     }
     return imageSource;

package/dist/lib/resources/aws/compute/imageTagParameter.d.ts

@@ -0,0 +1,29 @@
+import { CfnParameter } from "aws-cdk-lib";
+import { type Construct } from "constructs";
+import { type DockerBuild } from "@fjall/util/manifest/schemas";
+/** Which key namespace is registering the parameter. */
+export type ImageTagEntityKind = "ecs-service" | "lambda-image";
+/** Identity of the entity requesting the parameter, for collision reporting. */
+export interface ImageTagEntity {
+    readonly kind: ImageTagEntityKind;
+    /** ECS: the service name. Lambda: the function's construct id. */
+    readonly declaredBy: string;
+    readonly docker: DockerBuild | undefined;
+}
+/**
+ * Get or create the per-key image-tag CfnParameter (logical id from
+ * `imageTagParameterName`). Idempotent by logical id: a second call with the
+ * same key reuses the existing parameter (needed when several Lambda
+ * functions share one `image` build key, or when a service is wired up more
+ * than once within a stack). Distinct keys that happen to collide on the same
+ * PascalCase logical id fail closed rather than silently aliasing two
+ * different things onto one parameter.
+ *
+ * Cross-entity reuse (an ECS service name and a Lambda `image` key sharing
+ * one build key) is allowed only when both declare fingerprint-identical
+ * docker configs — the deliberate shared-build case. Any divergence
+ * (including docker-vs-no-docker) throws at synth, mirroring deploy-core's
+ * `assertNoCrossEntityBuildKeyDivergence`: a shared parameter with divergent
+ * builds means a deploy of either entity silently rolls both onto one image.
+ */
+export declare function getOrCreateImageTagParameter(scope: Construct, key: string, entity: ImageTagEntity): CfnParameter;

package/dist/lib/resources/aws/compute/imageTagParameter.js

@@ -0,0 +1,62 @@
+import { CfnParameter, Stack } from "aws-cdk-lib";
+import { imageTagParameterName } from "@fjall/util";
+import { dockerBuildFingerprint } from "@fjall/util/manifest/schemas";
+/** Per-parameter entity metadata; WeakMap keeps the registry per-stack and test-safe. */
+const registrations = new WeakMap();
+function buildImageTagDescription(key) {
+    return `Image tag for ${key}. Set by fjall deploy to the content-hash tag.`;
+}
+function describeEntity(kind, declaredBy) {
+    return kind === "ecs-service"
+        ? `ECS service "${declaredBy}"`
+        : `Lambda function "${declaredBy}"`;
+}
+/**
+ * Get or create the per-key image-tag CfnParameter (logical id from
+ * `imageTagParameterName`). Idempotent by logical id: a second call with the
+ * same key reuses the existing parameter (needed when several Lambda
+ * functions share one `image` build key, or when a service is wired up more
+ * than once within a stack). Distinct keys that happen to collide on the same
+ * PascalCase logical id fail closed rather than silently aliasing two
+ * different things onto one parameter.
+ *
+ * Cross-entity reuse (an ECS service name and a Lambda `image` key sharing
+ * one build key) is allowed only when both declare fingerprint-identical
+ * docker configs — the deliberate shared-build case. Any divergence
+ * (including docker-vs-no-docker) throws at synth, mirroring deploy-core's
+ * `assertNoCrossEntityBuildKeyDivergence`: a shared parameter with divergent
+ * builds means a deploy of either entity silently rolls both onto one image.
+ */
+export function getOrCreateImageTagParameter(scope, key, entity) {
+    const stack = Stack.of(scope);
+    const paramLogicalId = imageTagParameterName(key);
+    const description = buildImageTagDescription(key);
+    const existing = stack.node.tryFindChild(paramLogicalId);
+    if (existing instanceof CfnParameter) {
+        if (existing.description !== description) {
+            throw new Error(`CfnParameter logical-ID collision: "${paramLogicalId}" is already registered for a different service. ` +
+                `Distinct service/lambda names cannot share a PascalCase identifier — rename one of the conflicting entries.`);
+        }
+        const prior = registrations.get(existing);
+        const fingerprint = dockerBuildFingerprint(entity.docker);
+        if (prior !== undefined && prior.fingerprint !== fingerprint) {
+            throw new Error(`Image-tag parameter collision: ${describeEntity(prior.kind, prior.declaredBy)} and ` +
+                `${describeEntity(entity.kind, entity.declaredBy)} share the build key "${key}" ` +
+                `(CfnParameter "${paramLogicalId}") but declare different docker configs — ` +
+                `a deploy of either would silently roll both onto one image. Rename one of them, ` +
+                `or make the docker configs identical to deliberately share the build.`);
+        }
+        return existing;
+    }
+    const param = new CfnParameter(stack, paramLogicalId, {
+        type: "String",
+        default: "latest",
+        description
+    });
+    registrations.set(param, {
+        kind: entity.kind,
+        declaredBy: entity.declaredBy,
+        fingerprint: dockerBuildFingerprint(entity.docker)
+    });
+    return param;
+}

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -2,7 +2,7 @@ import { SingletonFunction as singletonFunction, Function, Code, type Runtime, A
 import { type Bucket } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, type IRole } from "aws-cdk-lib/aws-iam";
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
+import type { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type Construct } from "constructs";

package/dist/lib/resources/aws/compute/lambda.js

@@ -7,8 +7,7 @@ import { createHash } from "node:crypto";
 import { SqsEventSource, DynamoEventSource, S3EventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { EventType } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
-import { LogGroup } from "../logging/logGroup.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 import { buildParameterPath } from "@fjall/util";
 import { resolveImportedSecret } from "../secrets/index.js";
@@ -95,7 +94,10 @@ export class SingletonFunction extends singletonFunction {
             runtime: props.runtime,
             ephemeralStorageSize: props.ephemeralStorageSize
                 ? Size.mebibytes(props.ephemeralStorageSize)
-                : undefined
+                : undefined,
+            logGroup: new LogGroup(scope, `${id}LogGroup`, {
+                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         addPoliciesToRole(this, props.inlinePolicy);
         applyRoleDescription(this, props.roleDescription);
@@ -125,7 +127,7 @@ export class LambdaFunction extends Function {
             description: props.lambdaDescription ?? `${id} Lambda`,
             environment: props.environment,
             logGroup: new LogGroup(scope, `${id}LogGroup`, {
-                retention: props.logGroupRetention ?? RetentionDays.ONE_WEEK
+                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
             })
         });
         addPoliciesToRole(this, props.inlinePolicy);

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -6,6 +6,7 @@ import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { Provider } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
 import { SingletonFunction } from "../../compute/lambda.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../../logging/logGroup.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Resolves relative to the compiled location too — the build step copies the
@@ -51,7 +52,10 @@ export class IdentityStoreUserProvider extends Construct {
             ]
         });
         const provider = new Provider(this, "Provider", {
-            onEventHandler: handler
+            onEventHandler: handler,
+            logGroup: new LogGroup(this, "ProviderLogGroup", {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         this.serviceToken = provider.serviceToken;
     }

package/dist/lib/resources/aws/logging/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/index.js

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/logGroup.d.ts

@@ -1,5 +1,12 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
 import { type Construct } from "constructs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export declare const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export declare class LogGroup extends Logs.LogGroup {
     constructor(scope: Construct, id: string, props?: Logs.LogGroupProps);
 }

package/dist/lib/resources/aws/logging/logGroup.js

@@ -1,4 +1,11 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export class LogGroup extends Logs.LogGroup {
     constructor(scope, id, props) {
         super(scope, id, props);

package/dist/lib/resources/aws/logging/singletonLogGroup.d.ts

@@ -0,0 +1,15 @@
+import { type Construct } from "constructs";
+import { LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export declare function stackSingletonLogGroup(scope: Construct, purpose: "AwsCustomResource" | "BucketDeployment"): LogGroup;

package/dist/lib/resources/aws/logging/singletonLogGroup.js

@@ -0,0 +1,24 @@
+import { Stack } from "aws-cdk-lib";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export function stackSingletonLogGroup(scope, purpose) {
+    const stack = Stack.of(scope);
+    const id = `Fjall${purpose}LogGroup`;
+    const existing = stack.node.tryFindChild(id);
+    if (existing !== undefined)
+        return existing;
+    return new LogGroup(stack, id, {
+        retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+    });
+}

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -2,8 +2,9 @@ import { Construct } from "constructs";
 import { Stack, Tags } from "aws-cdk-lib";
 import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
     peeringConnectionId;

package/dist/lib/resources/aws/storage/bucketDeployment.d.ts

@@ -3,12 +3,11 @@ import { type Construct } from "constructs";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
  *
- * Currently a thin pass-through — no defaults are applied today. The wrapper
- * exists so that future SOC2 / compliance defaults (tags, retention, encryption
- * on the underlying Lambda + Custom Resource) reach every consumer in one edit.
- * Per `.claude/rules/generator-standards.md § Wrapper Routing Discipline` and
- * `patterns/infrastructure-wrapper-routing-pattern.md § A3` ("a wrapper that
- * is a thin pass-through today is still the routing point"), `lib/{config,
+ * Applies one default: an explicit, stack-shared log group for the deployment
+ * handler lambda, so it is CloudFormation-managed and tagged rather than
+ * service-auto-created. Per `.claude/rules/generator-standards.md § Wrapper
+ * Routing Discipline` and
+ * `patterns/infrastructure-wrapper-routing-pattern.md § A3`, `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
  */
 export declare class BucketDeployment extends CdkBucketDeployment {

package/dist/lib/resources/aws/storage/bucketDeployment.js

@@ -1,17 +1,24 @@
 import { BucketDeployment as CdkBucketDeployment } from "aws-cdk-lib/aws-s3-deployment";
+import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
  *
- * Currently a thin pass-through — no defaults are applied today. The wrapper
- * exists so that future SOC2 / compliance defaults (tags, retention, encryption
- * on the underlying Lambda + Custom Resource) reach every consumer in one edit.
- * Per `.claude/rules/generator-standards.md § Wrapper Routing Discipline` and
- * `patterns/infrastructure-wrapper-routing-pattern.md § A3` ("a wrapper that
- * is a thin pass-through today is still the routing point"), `lib/{config,
+ * Applies one default: an explicit, stack-shared log group for the deployment
+ * handler lambda, so it is CloudFormation-managed and tagged rather than
+ * service-auto-created. Per `.claude/rules/generator-standards.md § Wrapper
+ * Routing Discipline` and
+ * `patterns/infrastructure-wrapper-routing-pattern.md § A3`, `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
  */
 export class BucketDeployment extends CdkBucketDeployment {
     constructor(scope, id, props) {
-        super(scope, id, props);
+        super(scope, id, {
+            ...props,
+            // CDK dedupes the deployment handler to one lambda per stack (per
+            // memory/vpc variant), so the explicit log group must be the
+            // stack-shared one — a per-site group would only bind for whichever
+            // site instantiates first.
+            logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "BucketDeployment")
+        });
     }
 }

package/dist/lib/resources/aws/utilities/awsCustomResource.js

@@ -1,9 +1,14 @@
 import * as customResource from "aws-cdk-lib/custom-resources";
+import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 export class AwsCustomResource extends customResource.AwsCustomResource {
     response;
     constructor(scope, id, props) {
         super(scope, id, {
             ...props,
+            // Every AwsCustomResource in a stack shares CDK's one singleton lambda,
+            // so the explicit log group must be the stack-shared one — a per-site
+            // group would only bind for whichever site instantiates first.
+            logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "AwsCustomResource"),
             policy: props.policy ||
                 customResource.AwsCustomResourcePolicy.fromSdkCalls({
                     resources: customResource.AwsCustomResourcePolicy.ANY_RESOURCE

package/dist/lib/resources/aws/utilities/customResource.js

@@ -4,6 +4,7 @@ import { Code } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
 import { SingletonFunction, LambdaFunction } from "../compute/lambda.js";
 import { DEFAULT_CUSTOM_RESOURCE_TIMEOUT_SECONDS } from "../compute/ecsConstants.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 export class CustomResource extends Construct {
     response;
     resource;
@@ -54,7 +55,10 @@ export class CustomResource extends Construct {
                 inlinePolicy: props.inlinePolicy
             });
         const provider = new Provider(this, `${id}Provider`, {
-            onEventHandler: lambdaFunction
+            onEventHandler: lambdaFunction,
+            logGroup: new LogGroup(this, `${id}ProviderLogGroup`, {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         this.resource = new customResource(this, `${id}Resource`, {
             serviceToken: provider.serviceToken,

package/dist/lib/utils/validationLogger.d.ts

@@ -24,11 +24,11 @@ export declare const FjallLogger: {
  */
 export declare function warnIfPropertyIgnored<T extends {
     type: string;
-}>(props: T, property: string, applicableType: string | string[], typeName: string): void;
+}>(props: T, property: string, applicableType: string | string[], typeName: string, discriminatorLabel?: string): void;
 /**
  * Warn if any of the specified properties are set but will be ignored.
  * Convenience wrapper for checking multiple properties at once.
  */
 export declare function warnIfPropertiesIgnored<T extends {
     type: string;
-}>(props: T, properties: string[], applicableType: string | string[], typeName: string): void;
+}>(props: T, properties: string[], applicableType: string | string[], typeName: string, discriminatorLabel?: string): void;

package/dist/lib/utils/validationLogger.js

@@ -57,7 +57,7 @@ export const FjallLogger = {
  * @param applicableType - The type(s) where this property is used
  * @param typeName - Human-readable type name for the message
  */
-export function warnIfPropertyIgnored(props, property, applicableType, typeName) {
+export function warnIfPropertyIgnored(props, property, applicableType, typeName, discriminatorLabel = "type") {
     const propsRecord = props;
     const types = Array.isArray(applicableType)
         ? applicableType
@@ -66,15 +66,15 @@ export function warnIfPropertyIgnored(props, property, applicableType, typeName)
         property in propsRecord &&
         propsRecord[property] !== undefined) {
         FjallLogger.warn(`'${property}' is only used for ${typeName} type. ` +
-            `It will be ignored for type '${props.type}'.`);
+            `It will be ignored for ${discriminatorLabel} '${props.type}'.`);
     }
 }
 /**
  * Warn if any of the specified properties are set but will be ignored.
  * Convenience wrapper for checking multiple properties at once.
  */
-export function warnIfPropertiesIgnored(props, properties, applicableType, typeName) {
+export function warnIfPropertiesIgnored(props, properties, applicableType, typeName, discriminatorLabel = "type") {
     for (const property of properties) {
-        warnIfPropertyIgnored(props, property, applicableType, typeName);
+        warnIfPropertyIgnored(props, property, applicableType, typeName, discriminatorLabel);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.30.0",
+  "version": "2.31.1",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.30.0",
-    "@fjall/util": "^2.30.0",
+    "@fjall/generator": "^2.31.1",
+    "@fjall/util": "^2.31.1",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "ec35b16db566dfa5feb714c16f132c55b4663c86"
+  "gitHead": "a48cfaf6e050ce1736837802dfcaf517ba39f199"
 }