@fjall/components-infrastructure 2.30.3 → 2.31.1

package/dist/lib/config/aws/identityCenterMembership.d.ts

@@ -0,0 +1,11 @@
+import { NestedStack, type NestedStackProps } from "aws-cdk-lib";
+import { type Construct } from "constructs";
+export interface IdentityCenterMembershipProps extends NestedStackProps {
+    identityStoreId: string;
+    groupId: string;
+    groupMembers: string[];
+}
+export declare function validateIdentityCenterMembershipProps(props: IdentityCenterMembershipProps): void;
+export declare class IdentityCenterMembership extends NestedStack {
+    constructor(scope: Construct, id: string, props: IdentityCenterMembershipProps);
+}

package/dist/lib/config/aws/identityCenterMembership.js

@@ -0,0 +1,61 @@
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { NestedStack } from "aws-cdk-lib";
+import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
+import { GroupMembership } from "../../resources/aws/iam/identityCenter/groupMembership.js";
+import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
+const IDENTITY_STORE_SERVICE = "identityStore";
+export function validateIdentityCenterMembershipProps(props) {
+    if (!props.identityStoreId) {
+        throw new Error("IdentityCenterMembership requires identityStoreId from the parent IdentityCenter construct.");
+    }
+    if (!props.groupId) {
+        throw new Error("IdentityCenterMembership requires groupId from a Group construct.");
+    }
+    if (props.groupMembers.length === 0) {
+        throw new Error("IdentityCenterMembership requires at least one member email. Empty groups should be skipped at the caller.");
+    }
+    const seen = new Set();
+    for (const member of props.groupMembers) {
+        if (!member.includes("@")) {
+            throw new Error(`IdentityCenterMembership: "${member}" is not a valid email — Identity Center memberships look up users by UserName (email)`);
+        }
+        if (seen.has(member)) {
+            throw new Error(`Duplicate member "${member}" in IdentityCenterMembership groupMembers.`);
+        }
+        seen.add(member);
+    }
+}
+export class IdentityCenterMembership extends NestedStack {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        validateIdentityCenterMembershipProps(props);
+        for (const member of props.groupMembers) {
+            const [localPart] = member.split("@");
+            const suffix = stripAndCamelCase(localPart ?? member);
+            const listUsersCall = {
+                service: IDENTITY_STORE_SERVICE,
+                action: "listUsers",
+                parameters: {
+                    IdentityStoreId: props.identityStoreId,
+                    Filters: [
+                        {
+                            AttributePath: "UserName",
+                            AttributeValue: member
+                        }
+                    ]
+                },
+                physicalResourceId: customResources.PhysicalResourceId.of(`listUsers${suffix}`)
+            };
+            const userLookup = new AwsCustomResource(this, `User${suffix}`, {
+                onCreate: listUsersCall,
+                onUpdate: listUsersCall
+            });
+            const userId = userLookup.getResponseField("Users.0.UserId");
+            new GroupMembership(this, `Membership${suffix}`, {
+                identityStoreId: props.identityStoreId,
+                groupId: props.groupId,
+                userId
+            });
+        }
+    }
+}

package/dist/lib/config/aws/oidcConnector.js

@@ -1,5 +1,5 @@
 import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, FJALL_OIDC_AUDIENCE, FJALL_OIDC_ISSUER_DOMAIN, FJALL_OIDC_PLACEHOLDER_THUMBPRINT, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
-import { CfnOutput, Duration, Stack } from "aws-cdk-lib";
+import { Aws, CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
@@ -80,15 +80,23 @@ export class OidcConnector extends Construct {
             resourceType: "Custom::FjallOidcProvider",
             properties: { IssuerUrl: issuerUrl },
             inlinePolicy: [
+                // iam:ListOpenIDConnectProviders supports no resource-level
+                // permission — the star grants provider-list metadata only.
+                new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: ["iam:ListOpenIDConnectProviders"],
+                    resources: ["*"]
+                }),
                 new iam.PolicyStatement({
                     effect: iam.Effect.ALLOW,
                     actions: [
-                        "iam:ListOpenIDConnectProviders",
                         "iam:GetOpenIDConnectProvider",
                         "iam:CreateOpenIDConnectProvider",
                         "iam:AddClientIDToOpenIDConnectProvider"
                     ],
-                    resources: ["*"]
+                    resources: [
+                        `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:oidc-provider/${issuerDomain}`
+                    ]
                 })
             ],
             inlineCode: OIDC_PROVIDER_HANDLER

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -3,11 +3,20 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)

package/dist/lib/patterns/aws/compute.d.ts

@@ -4,9 +4,9 @@ import { type SecretImport } from "../../resources/aws/secrets/index.js";
 import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compute, type AnyCompute, isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import type App from "../../app.js";
 import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
+import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
 import { Ec2Compute, type Ec2ComputeProps, type SshConfig } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/compute.js

@@ -3,18 +3,19 @@ import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { buildParameterPath } from "@fjall/util";
 import { isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import { warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
+import { COMPUTE_WARN_GROUPS, CONTAINER_LAMBDA_ONLY_PROPS, CODE_LAMBDA_ONLY_PROPS } from "./computePropApplicability.js";
 import { applyInferredPublicBuildArgs } from "./computeBuildArgInference.js";
 import { DEFAULT_ECS_FALLBACK_IMAGE, DEFAULT_EC2_INSTANCE_TYPE } from "../../resources/aws/compute/ecsConstants.js";
 // Import and re-export from per-pattern files
 import { EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
+import { LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
 import { Ec2Compute } from "./computeEc2.js";
 // Re-export everything from per-pattern files
 export { 
 // ECS
 EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig, 
 // Lambda
-LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, 
+LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, 
 // EC2
 Ec2Compute };
 export const COMPUTE_TYPE_CONFIG = {
@@ -90,12 +91,20 @@ export function getComputeTypeConfig(type) {
  * TypeScript's compile-time checks may not apply.
  */
 function validateComputeProps(props) {
-    // ECS-specific options on non-ECS compute
-    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config", "services", "cluster"], "ecs", "ECS compute");
-    // Lambda-specific options on non-Lambda compute
-    warnIfPropertiesIgnored(props, ["functionUrl", "handler", "runtime"], "lambda", "Lambda compute");
-    // EC2-specific options on non-EC2 compute
-    warnIfPropertiesIgnored(props, ["ssh", "userData", "machineImage"], "ec2", "EC2 compute");
+    for (const group of COMPUTE_WARN_GROUPS) {
+        warnIfPropertiesIgnored(props, group.properties, group.applicableTypes, group.typeName);
+    }
+    // capacityProvider/ec2Config are EcsServiceConfig-level keys, not top-level
+    // EcsComputeProps, so the guard Record in computePropApplicability.ts would
+    // reject them — hand-curated misuse hints stay outside it.
+    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config"], "ecs", "ECS compute");
+    if (props.type === "lambda") {
+        // warnIfPropertyIgnored reads only `.type` + presence, so a
+        // deployment-keyed view reuses the same machinery for the second axis.
+        const byDeployment = { ...props, type: props.deployment };
+        warnIfPropertiesIgnored(byDeployment, CONTAINER_LAMBDA_ONLY_PROPS, "container", "container-deployment Lambda", "deployment");
+        warnIfPropertiesIgnored(byDeployment, CODE_LAMBDA_ONLY_PROPS, "code", "code-deployment Lambda", "deployment");
+    }
     // ECS-specific validation - type narrowing handled by discriminated union
     if (props.type === "ecs") {
         validateEcsProps(props);
@@ -249,7 +258,7 @@ export class ComputeFactory {
                     if (lambdaComputeProps.deployment === "container" &&
                         lambdaComputeProps.docker !== undefined) {
                         manifestLambda.docker = lambdaComputeProps.docker;
-                        manifestLambda.imageKey = lambdaComputeProps.image ?? id;
+                        manifestLambda.imageKey = lambdaImageKey(lambdaComputeProps, id);
                     }
                     collector.addLambda(manifestLambda);
                     return new LambdaCompute(scope, id, lambdaComputeProps);

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -185,7 +185,9 @@ export interface CodeLambdaProps extends BaseLambdaProps {
  * Lambda compute configuration.
  *
  * Discriminated union ensuring type-safe Lambda configuration:
- * - `deployment: "container"` requires `ecrRepository`
+ * - `deployment: "container"` takes `ecrRepository` (bring-your-own image)
+ *   and/or `docker` (fjall builds and pushes; `ecrRepository` then defaults
+ *   to the app's shared default container registry)
  * - `deployment: "code"` requires `code` and allows `handler`/`runtime`
  *
  * @example
@@ -205,6 +207,18 @@ export interface ResolvedLambdaDeployment {
     handler: string;
     runtime: Runtime;
 }
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export declare function lambdaImageKey(props: {
+    image?: string;
+}, id: string): string;
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.

package/dist/lib/patterns/aws/computeLambda.js

@@ -10,6 +10,18 @@ import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab } from "@fjall/util";
 // Re-export Lambda types from CDK for user convenience
 export { Architecture, HttpMethod, InvokeMode } from "aws-cdk-lib/aws-lambda";
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export function lambdaImageKey(props, id) {
+    return props.image !== undefined && props.image !== "" ? props.image : id;
+}
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
@@ -33,8 +45,12 @@ export function resolveLambdaDeployment(scope, id, props) {
             if (findings.length > 0) {
                 throw new Error(`Lambda '${id}': ${findings.map((f) => f.message).join(" ")}`);
             }
-            const tagKey = props.image ?? id;
-            const param = getOrCreateImageTagParameter(scope, tagKey);
+            const tagKey = lambdaImageKey(props, id);
+            const param = getOrCreateImageTagParameter(scope, tagKey, {
+                kind: "lambda-image",
+                declaredBy: id,
+                docker: props.docker
+            });
             return {
                 code: Code.fromEcrImage(props.ecrRepository, {
                     tagOrDigest: param.valueAsString

package/dist/lib/patterns/aws/computePropApplicability.d.ts

@@ -0,0 +1,20 @@
+import type { ComputeType } from "./interfaces/compute.js";
+import type { EcsComputeProps } from "./computeEcsTypes.js";
+import type { LambdaComputeProps } from "./computeLambda.js";
+import type { Ec2ComputeProps } from "./computeEc2.js";
+type KeysOfUnion<T> = T extends unknown ? keyof T : never;
+type AllComputePropKeys = keyof EcsComputeProps | KeysOfUnion<LambdaComputeProps> | keyof Ec2ComputeProps;
+export interface ComputeWarnGroup {
+    properties: string[];
+    applicableTypes: ComputeType[];
+    typeName: string;
+}
+export declare const COMPUTE_WARN_GROUPS: readonly ComputeWarnGroup[];
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export declare const ALL_COMPUTE_PROP_KEYS: AllComputePropKeys[];
+export declare const CONTAINER_LAMBDA_ONLY_PROPS: string[];
+export declare const CODE_LAMBDA_ONLY_PROPS: string[];
+export {};

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -0,0 +1,87 @@
+/**
+ * Compile-time lockstep guard for `validateComputeProps`'s ignored-prop
+ * warnings. The Record over the full top-level key union rejects BOTH a
+ * missing key (a new prop added to any compute props interface fails TS2741
+ * here until classified) and a stale extra key (a removed/renamed prop fails
+ * TS2353). `"all"` means the prop is legitimate on every compute type and
+ * never warns.
+ */
+const COMPUTE_PROP_APPLICABILITY = {
+    type: "all",
+    vpc: "all",
+    appName: ["ecs", "lambda"],
+    docker: ["ecs", "lambda"],
+    ecrRepository: ["ecs", "lambda"],
+    cluster: ["ecs"],
+    services: ["ecs"],
+    alertsTopic: ["ecs"],
+    applicationId: ["ecs"],
+    deployment: ["lambda"],
+    functionUrl: ["lambda"],
+    handler: ["lambda"],
+    runtime: ["lambda"],
+    code: ["lambda"],
+    image: ["lambda"],
+    timeout: ["lambda"],
+    memorySize: ["lambda"],
+    ephemeralStorageSize: ["lambda"],
+    architecture: ["lambda"],
+    description: ["lambda"],
+    roleDescription: ["lambda"],
+    inlinePolicy: ["lambda"],
+    environment: ["lambda"],
+    secrets: ["lambda"],
+    ssmSecretsPath: ["lambda"],
+    secretsImport: ["lambda"],
+    connections: ["lambda"],
+    instanceType: ["ec2"],
+    ssh: ["ec2"],
+    userData: ["ec2"],
+    machineImage: ["ec2"],
+    minCapacity: ["ec2"],
+    maxCapacity: ["ec2"],
+    spotCapacityPercentage: ["ec2"]
+};
+const TYPE_LABELS = {
+    ecs: "ECS",
+    lambda: "Lambda",
+    ec2: "EC2"
+};
+export const COMPUTE_WARN_GROUPS = (() => {
+    const groups = new Map();
+    for (const [prop, applicability] of Object.entries(COMPUTE_PROP_APPLICABILITY)) {
+        if (applicability === "all")
+            continue;
+        const key = applicability.join("+");
+        const existing = groups.get(key);
+        if (existing !== undefined) {
+            existing.properties.push(prop);
+        }
+        else {
+            groups.set(key, {
+                properties: [prop],
+                applicableTypes: [...applicability],
+                typeName: applicability.map((t) => TYPE_LABELS[t]).join(" or ") + " compute"
+            });
+        }
+    }
+    return [...groups.values()];
+})();
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export const ALL_COMPUTE_PROP_KEYS = Object.keys(COMPUTE_PROP_APPLICABILITY);
+const LAMBDA_DEPLOYMENT_APPLICABILITY = {
+    ecrRepository: "container",
+    docker: "container",
+    image: "container",
+    code: "code",
+    handler: "code",
+    runtime: "code"
+};
+const deploymentProps = (d) => Object.entries(LAMBDA_DEPLOYMENT_APPLICABILITY)
+    .filter(([, v]) => v === d)
+    .map(([k]) => k);
+export const CONTAINER_LAMBDA_ONLY_PROPS = deploymentProps("container");
+export const CODE_LAMBDA_ONLY_PROPS = deploymentProps("code");

package/dist/lib/resources/aws/compute/ecsImages.js

@@ -7,6 +7,11 @@ export function getContainerImage(ctx, serviceName, containerConfig, serviceProp
     if (!imageSource) {
         return ContainerImage.fromRegistry(DEFAULT_ECS_FALLBACK_IMAGE);
     }
+    const entity = {
+        kind: "ecs-service",
+        declaredBy: serviceName,
+        docker: serviceProps.docker
+    };
     if (typeof imageSource === "string") {
         const isFullRegistryUrl = /^(docker\.io|registry\.hub\.docker\.com|ghcr\.io)\//i.test(imageSource) ||
             imageSource.startsWith("public.ecr.aws/") ||
@@ -14,11 +19,11 @@ export function getContainerImage(ctx, serviceName, containerConfig, serviceProp
         if (isFullRegistryUrl) {
             return ContainerImage.fromRegistry(imageSource);
         }
-        const param = getOrCreateImageTagParameter(ctx.scope, serviceName);
+        const param = getOrCreateImageTagParameter(ctx.scope, serviceName, entity);
         return ContainerImage.fromEcrRepository(Repository.fromRepositoryName(ctx.scope, `${serviceName}${containerConfig.name}EcrRepo`, imageSource), param.valueAsString);
     }
     if (imageSource instanceof Repository) {
-        const param = getOrCreateImageTagParameter(ctx.scope, serviceName);
+        const param = getOrCreateImageTagParameter(ctx.scope, serviceName, entity);
         return ContainerImage.fromEcrRepository(imageSource, param.valueAsString);
     }
     return imageSource;

package/dist/lib/resources/aws/compute/imageTagParameter.d.ts

@@ -1,5 +1,15 @@
 import { CfnParameter } from "aws-cdk-lib";
 import { type Construct } from "constructs";
+import { type DockerBuild } from "@fjall/util/manifest/schemas";
+/** Which key namespace is registering the parameter. */
+export type ImageTagEntityKind = "ecs-service" | "lambda-image";
+/** Identity of the entity requesting the parameter, for collision reporting. */
+export interface ImageTagEntity {
+    readonly kind: ImageTagEntityKind;
+    /** ECS: the service name. Lambda: the function's construct id. */
+    readonly declaredBy: string;
+    readonly docker: DockerBuild | undefined;
+}
 /**
  * Get or create the per-key image-tag CfnParameter (logical id from
  * `imageTagParameterName`). Idempotent by logical id: a second call with the
@@ -8,5 +18,12 @@ import { type Construct } from "constructs";
  * than once within a stack). Distinct keys that happen to collide on the same
  * PascalCase logical id fail closed rather than silently aliasing two
  * different things onto one parameter.
+ *
+ * Cross-entity reuse (an ECS service name and a Lambda `image` key sharing
+ * one build key) is allowed only when both declare fingerprint-identical
+ * docker configs — the deliberate shared-build case. Any divergence
+ * (including docker-vs-no-docker) throws at synth, mirroring deploy-core's
+ * `assertNoCrossEntityBuildKeyDivergence`: a shared parameter with divergent
+ * builds means a deploy of either entity silently rolls both onto one image.
  */
-export declare function getOrCreateImageTagParameter(scope: Construct, key: string): CfnParameter;
+export declare function getOrCreateImageTagParameter(scope: Construct, key: string, entity: ImageTagEntity): CfnParameter;

package/dist/lib/resources/aws/compute/imageTagParameter.js

@@ -1,8 +1,16 @@
 import { CfnParameter, Stack } from "aws-cdk-lib";
 import { imageTagParameterName } from "@fjall/util";
+import { dockerBuildFingerprint } from "@fjall/util/manifest/schemas";
+/** Per-parameter entity metadata; WeakMap keeps the registry per-stack and test-safe. */
+const registrations = new WeakMap();
 function buildImageTagDescription(key) {
     return `Image tag for ${key}. Set by fjall deploy to the content-hash tag.`;
 }
+function describeEntity(kind, declaredBy) {
+    return kind === "ecs-service"
+        ? `ECS service "${declaredBy}"`
+        : `Lambda function "${declaredBy}"`;
+}
 /**
  * Get or create the per-key image-tag CfnParameter (logical id from
  * `imageTagParameterName`). Idempotent by logical id: a second call with the
@@ -11,8 +19,15 @@ function buildImageTagDescription(key) {
  * than once within a stack). Distinct keys that happen to collide on the same
  * PascalCase logical id fail closed rather than silently aliasing two
  * different things onto one parameter.
+ *
+ * Cross-entity reuse (an ECS service name and a Lambda `image` key sharing
+ * one build key) is allowed only when both declare fingerprint-identical
+ * docker configs — the deliberate shared-build case. Any divergence
+ * (including docker-vs-no-docker) throws at synth, mirroring deploy-core's
+ * `assertNoCrossEntityBuildKeyDivergence`: a shared parameter with divergent
+ * builds means a deploy of either entity silently rolls both onto one image.
  */
-export function getOrCreateImageTagParameter(scope, key) {
+export function getOrCreateImageTagParameter(scope, key, entity) {
     const stack = Stack.of(scope);
     const paramLogicalId = imageTagParameterName(key);
     const description = buildImageTagDescription(key);
@@ -22,11 +37,26 @@ export function getOrCreateImageTagParameter(scope, key) {
             throw new Error(`CfnParameter logical-ID collision: "${paramLogicalId}" is already registered for a different service. ` +
                 `Distinct service/lambda names cannot share a PascalCase identifier — rename one of the conflicting entries.`);
         }
+        const prior = registrations.get(existing);
+        const fingerprint = dockerBuildFingerprint(entity.docker);
+        if (prior !== undefined && prior.fingerprint !== fingerprint) {
+            throw new Error(`Image-tag parameter collision: ${describeEntity(prior.kind, prior.declaredBy)} and ` +
+                `${describeEntity(entity.kind, entity.declaredBy)} share the build key "${key}" ` +
+                `(CfnParameter "${paramLogicalId}") but declare different docker configs — ` +
+                `a deploy of either would silently roll both onto one image. Rename one of them, ` +
+                `or make the docker configs identical to deliberately share the build.`);
+        }
         return existing;
     }
-    return new CfnParameter(stack, paramLogicalId, {
+    const param = new CfnParameter(stack, paramLogicalId, {
         type: "String",
         default: "latest",
         description
     });
+    registrations.set(param, {
+        kind: entity.kind,
+        declaredBy: entity.declaredBy,
+        fingerprint: dockerBuildFingerprint(entity.docker)
+    });
+    return param;
 }

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -2,7 +2,7 @@ import { SingletonFunction as singletonFunction, Function, Code, type Runtime, A
 import { type Bucket } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, type IRole } from "aws-cdk-lib/aws-iam";
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
+import type { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type Construct } from "constructs";

package/dist/lib/resources/aws/compute/lambda.js

@@ -7,8 +7,7 @@ import { createHash } from "node:crypto";
 import { SqsEventSource, DynamoEventSource, S3EventSource } from "aws-cdk-lib/aws-lambda-event-sources";
 import { EventType } from "aws-cdk-lib/aws-s3";
 import { PolicyStatement, Effect } from "aws-cdk-lib/aws-iam";
-import { RetentionDays } from "aws-cdk-lib/aws-logs";
-import { LogGroup } from "../logging/logGroup.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 import { buildParameterPath } from "@fjall/util";
 import { resolveImportedSecret } from "../secrets/index.js";
@@ -95,7 +94,10 @@ export class SingletonFunction extends singletonFunction {
             runtime: props.runtime,
             ephemeralStorageSize: props.ephemeralStorageSize
                 ? Size.mebibytes(props.ephemeralStorageSize)
-                : undefined
+                : undefined,
+            logGroup: new LogGroup(scope, `${id}LogGroup`, {
+                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         addPoliciesToRole(this, props.inlinePolicy);
         applyRoleDescription(this, props.roleDescription);
@@ -125,7 +127,7 @@ export class LambdaFunction extends Function {
             description: props.lambdaDescription ?? `${id} Lambda`,
             environment: props.environment,
             logGroup: new LogGroup(scope, `${id}LogGroup`, {
-                retention: props.logGroupRetention ?? RetentionDays.ONE_WEEK
+                retention: props.logGroupRetention ?? DEFAULT_FRAMEWORK_LOG_RETENTION
             })
         });
         addPoliciesToRole(this, props.inlinePolicy);

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -6,6 +6,7 @@ import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { Provider } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
 import { SingletonFunction } from "../../compute/lambda.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../../logging/logGroup.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Resolves relative to the compiled location too — the build step copies the
@@ -51,7 +52,10 @@ export class IdentityStoreUserProvider extends Construct {
             ]
         });
         const provider = new Provider(this, "Provider", {
-            onEventHandler: handler
+            onEventHandler: handler,
+            logGroup: new LogGroup(this, "ProviderLogGroup", {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         this.serviceToken = provider.serviceToken;
     }

package/dist/lib/resources/aws/logging/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/index.js

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/logGroup.d.ts

@@ -1,5 +1,12 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
 import { type Construct } from "constructs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export declare const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export declare class LogGroup extends Logs.LogGroup {
     constructor(scope: Construct, id: string, props?: Logs.LogGroupProps);
 }

package/dist/lib/resources/aws/logging/logGroup.js

@@ -1,4 +1,11 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export class LogGroup extends Logs.LogGroup {
     constructor(scope, id, props) {
         super(scope, id, props);

package/dist/lib/resources/aws/logging/singletonLogGroup.d.ts

@@ -0,0 +1,15 @@
+import { type Construct } from "constructs";
+import { LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export declare function stackSingletonLogGroup(scope: Construct, purpose: "AwsCustomResource" | "BucketDeployment"): LogGroup;

package/dist/lib/resources/aws/logging/singletonLogGroup.js

@@ -0,0 +1,24 @@
+import { Stack } from "aws-cdk-lib";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export function stackSingletonLogGroup(scope, purpose) {
+    const stack = Stack.of(scope);
+    const id = `Fjall${purpose}LogGroup`;
+    const existing = stack.node.tryFindChild(id);
+    if (existing !== undefined)
+        return existing;
+    return new LogGroup(stack, id, {
+        retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+    });
+}