@fjall/components-infrastructure 2.30.3 → 2.32.0

package/dist/lib/app.d.ts

@@ -16,6 +16,7 @@ import { type RemovalPolicyString } from "./resources/aws/messaging/utils.js";
 import { type ServiceRegistrationProps } from "./resources/aws/networking/serviceDiscovery.js";
 import { type IPrivateDnsNamespace, type IService } from "aws-cdk-lib/aws-servicediscovery";
 import { type AnyCompute } from "./patterns/aws/compute.js";
+import { DevSubstrate, type IDevSubstrateProps } from "./patterns/aws/devSubstrate.js";
 import { type Storage, type StorageFactoryFn } from "./patterns/aws/storage.js";
 import { type AnyPattern, type PatternFactoryFn } from "./patterns/aws/pattern.js";
 import { type BackupTier } from "./utils/backupTierMapping.js";
@@ -242,6 +243,23 @@ export declare class App extends CdkApp {
      */
     addCompute<T extends AnyCompute & Construct>(fn: (app: App, scope: Construct) => T): T;
     addComputeResource(resource: Construct): void;
+    /**
+     * Instantiate the internal `DevSubstrate` construct on the default compute
+     * stack (fast dev-envs Phase 3).
+     *
+     * Deliberately NOT routed through `PATTERN_TYPE_VALUES` / the pattern registry
+     * / `PatternFactory` / the `IPatternProps` union — the substrate is
+     * Fjall-managed dev infrastructure, never offered on the customer
+     * create/scaffold surface (design R5).
+     *
+     * Placement is load-bearing at DEPLOY time, not just synth: deploy-core selects
+     * stacks by a fixed six-category enum and derives deploy-order flags from
+     * post-synth stack-name suffixes (`endsWith("Compute")`), so scoping the
+     * substrate under `${stackPrefix}Compute` via `getDefaultComputeStack()` is
+     * what makes it actually deploy (design VF2). A dedicated `…DevSubstrate` stack
+     * would synth and hash but never deploy.
+     */
+    addDevSubstrate(props: IDevSubstrateProps): DevSubstrate;
     /**
      * Add a database resource to the default database stack using the factory pattern.
      * Returns the appropriate database type based on the factory used.
@@ -341,8 +359,16 @@ export declare class App extends CdkApp {
      *   visibilityTimeout: 300,
      *   contentBasedDeduplication: true
      * }));
+     *
+     * Pass `stackPlacement: "compute"` to co-locate the queue in the compute stack
+     * (mirrors `addStorage`/`addSchedule`). Required when a bucket's notification
+     * targets the queue within one app: an S3 notification and its auto-generated
+     * SQS queue policy reference each other's ARN, so splitting the two across the
+     * Storage and Messaging stacks synthesises a fatal cross-stack dependency cycle.
      */
-    addMessaging<T extends AnyMessaging & Construct>(fn: (app: App, scope: Construct) => T): T;
+    addMessaging<T extends AnyMessaging & Construct>(fn: (app: App, scope: Construct) => T, opts?: {
+        stackPlacement?: "messaging" | "compute";
+    }): T;
     /**
      * Register an EventBridge schedule against a Fjall wrapper target.
      *

package/dist/lib/app.js

@@ -9,6 +9,7 @@ import { NetworkFactory } from "./patterns/aws/network.js";
 import { MessagingFactory } from "./patterns/aws/messaging.js";
 import { Schedule } from "./resources/aws/messaging/schedule.js";
 import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDiscovery.js";
+import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
 import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
@@ -413,6 +414,28 @@ export class App extends CdkApp {
         const computeStack = this.getDefaultComputeStack();
         computeStack.addConstruct(resource);
     }
+    /**
+     * Instantiate the internal `DevSubstrate` construct on the default compute
+     * stack (fast dev-envs Phase 3).
+     *
+     * Deliberately NOT routed through `PATTERN_TYPE_VALUES` / the pattern registry
+     * / `PatternFactory` / the `IPatternProps` union — the substrate is
+     * Fjall-managed dev infrastructure, never offered on the customer
+     * create/scaffold surface (design R5).
+     *
+     * Placement is load-bearing at DEPLOY time, not just synth: deploy-core selects
+     * stacks by a fixed six-category enum and derives deploy-order flags from
+     * post-synth stack-name suffixes (`endsWith("Compute")`), so scoping the
+     * substrate under `${stackPrefix}Compute` via `getDefaultComputeStack()` is
+     * what makes it actually deploy (design VF2). A dedicated `…DevSubstrate` stack
+     * would synth and hash but never deploy.
+     */
+    addDevSubstrate(props) {
+        const computeStack = this.getDefaultComputeStack();
+        const substrate = new DevSubstrate(computeStack.getStack(), "DevSubstrate", this, props);
+        computeStack.addConstruct(substrate);
+        return substrate;
+    }
     /**
      * Add a database resource to the default database stack using the factory pattern.
      * Returns the appropriate database type based on the factory used.
@@ -556,11 +579,19 @@ export class App extends CdkApp {
      *   visibilityTimeout: 300,
      *   contentBasedDeduplication: true
      * }));
+     *
+     * Pass `stackPlacement: "compute"` to co-locate the queue in the compute stack
+     * (mirrors `addStorage`/`addSchedule`). Required when a bucket's notification
+     * targets the queue within one app: an S3 notification and its auto-generated
+     * SQS queue policy reference each other's ARN, so splitting the two across the
+     * Storage and Messaging stacks synthesises a fatal cross-stack dependency cycle.
      */
-    addMessaging(fn) {
-        const messagingStack = this.getDefaultMessagingStack();
-        const messaging = fn(this, messagingStack.getStack());
-        messagingStack.addConstruct(messaging);
+    addMessaging(fn, opts = {}) {
+        const stack = opts.stackPlacement === "compute"
+            ? this.getDefaultComputeStack()
+            : this.getDefaultMessagingStack();
+        const messaging = fn(this, stack.getStack());
+        stack.addConstruct(messaging);
         return messaging;
     }
     /**

package/dist/lib/config/aws/identityCenterMembership.d.ts

@@ -0,0 +1,11 @@
+import { NestedStack, type NestedStackProps } from "aws-cdk-lib";
+import { type Construct } from "constructs";
+export interface IdentityCenterMembershipProps extends NestedStackProps {
+    identityStoreId: string;
+    groupId: string;
+    groupMembers: string[];
+}
+export declare function validateIdentityCenterMembershipProps(props: IdentityCenterMembershipProps): void;
+export declare class IdentityCenterMembership extends NestedStack {
+    constructor(scope: Construct, id: string, props: IdentityCenterMembershipProps);
+}

package/dist/lib/config/aws/identityCenterMembership.js

@@ -0,0 +1,61 @@
+import * as customResources from "aws-cdk-lib/custom-resources";
+import { NestedStack } from "aws-cdk-lib";
+import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
+import { GroupMembership } from "../../resources/aws/iam/identityCenter/groupMembership.js";
+import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
+const IDENTITY_STORE_SERVICE = "identityStore";
+export function validateIdentityCenterMembershipProps(props) {
+    if (!props.identityStoreId) {
+        throw new Error("IdentityCenterMembership requires identityStoreId from the parent IdentityCenter construct.");
+    }
+    if (!props.groupId) {
+        throw new Error("IdentityCenterMembership requires groupId from a Group construct.");
+    }
+    if (props.groupMembers.length === 0) {
+        throw new Error("IdentityCenterMembership requires at least one member email. Empty groups should be skipped at the caller.");
+    }
+    const seen = new Set();
+    for (const member of props.groupMembers) {
+        if (!member.includes("@")) {
+            throw new Error(`IdentityCenterMembership: "${member}" is not a valid email — Identity Center memberships look up users by UserName (email)`);
+        }
+        if (seen.has(member)) {
+            throw new Error(`Duplicate member "${member}" in IdentityCenterMembership groupMembers.`);
+        }
+        seen.add(member);
+    }
+}
+export class IdentityCenterMembership extends NestedStack {
+    constructor(scope, id, props) {
+        super(scope, id, props);
+        validateIdentityCenterMembershipProps(props);
+        for (const member of props.groupMembers) {
+            const [localPart] = member.split("@");
+            const suffix = stripAndCamelCase(localPart ?? member);
+            const listUsersCall = {
+                service: IDENTITY_STORE_SERVICE,
+                action: "listUsers",
+                parameters: {
+                    IdentityStoreId: props.identityStoreId,
+                    Filters: [
+                        {
+                            AttributePath: "UserName",
+                            AttributeValue: member
+                        }
+                    ]
+                },
+                physicalResourceId: customResources.PhysicalResourceId.of(`listUsers${suffix}`)
+            };
+            const userLookup = new AwsCustomResource(this, `User${suffix}`, {
+                onCreate: listUsersCall,
+                onUpdate: listUsersCall
+            });
+            const userId = userLookup.getResponseField("Users.0.UserId");
+            new GroupMembership(this, `Membership${suffix}`, {
+                identityStoreId: props.identityStoreId,
+                groupId: props.groupId,
+                userId
+            });
+        }
+    }
+}

package/dist/lib/config/aws/oidcConnector.js

@@ -1,5 +1,5 @@
 import { DEV_BOUNDARY_POLICY_NAME, DEV_DEPLOY_POLICY_NAME, DEV_PROVISIONER_POLICY_NAME, DEV_SYNC_WRITER_POLICY_NAME, FJALL_OIDC_AUDIENCE, FJALL_OIDC_ISSUER_DOMAIN, FJALL_OIDC_PLACEHOLDER_THUMBPRINT, SECURITY_TIER_TO_BOUNDARY, buildDevBoundaryStatements, buildDevDeployPolicyStatements, buildDevDeployTrustStatements, buildDevProvisionerPolicyStatements, buildDevProvisionerTrustStatements, buildDevSyncWriterPolicyStatements, buildDevSyncWriterTrustStatements, buildNarrowedDeployTrustStatements, deployBoundaryName, devDeployRoleName, devProvisionerRoleName, devSyncWriterRoleName } from "@fjall/generator";
-import { CfnOutput, Duration, Stack } from "aws-cdk-lib";
+import { Aws, CfnOutput, Duration, Stack } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
@@ -80,15 +80,23 @@ export class OidcConnector extends Construct {
             resourceType: "Custom::FjallOidcProvider",
             properties: { IssuerUrl: issuerUrl },
             inlinePolicy: [
+                // iam:ListOpenIDConnectProviders supports no resource-level
+                // permission — the star grants provider-list metadata only.
+                new iam.PolicyStatement({
+                    effect: iam.Effect.ALLOW,
+                    actions: ["iam:ListOpenIDConnectProviders"],
+                    resources: ["*"]
+                }),
                 new iam.PolicyStatement({
                     effect: iam.Effect.ALLOW,
                     actions: [
-                        "iam:ListOpenIDConnectProviders",
                         "iam:GetOpenIDConnectProvider",
                         "iam:CreateOpenIDConnectProvider",
                         "iam:AddClientIDToOpenIDConnectProvider"
                     ],
-                    resources: ["*"]
+                    resources: [
+                        `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:oidc-provider/${issuerDomain}`
+                    ]
                 })
             ],
             inlineCode: OIDC_PROVIDER_HANDLER

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -3,11 +3,20 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)

package/dist/lib/patterns/aws/compute.d.ts

@@ -4,9 +4,9 @@ import { type SecretImport } from "../../resources/aws/secrets/index.js";
 import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compute, type AnyCompute, isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import type App from "../../app.js";
 import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
+import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
 import { Ec2Compute, type Ec2ComputeProps, type SshConfig } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/compute.js

@@ -3,18 +3,19 @@ import { Runtime } from "aws-cdk-lib/aws-lambda";
 import { buildParameterPath } from "@fjall/util";
 import { isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import { warnIfPropertiesIgnored } from "../../utils/validationLogger.js";
+import { COMPUTE_WARN_GROUPS, CONTAINER_LAMBDA_ONLY_PROPS, CODE_LAMBDA_ONLY_PROPS } from "./computePropApplicability.js";
 import { applyInferredPublicBuildArgs } from "./computeBuildArgInference.js";
 import { DEFAULT_ECS_FALLBACK_IMAGE, DEFAULT_EC2_INSTANCE_TYPE } from "../../resources/aws/compute/ecsConstants.js";
 // Import and re-export from per-pattern files
 import { EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig } from "./computeEcs.js";
-import { LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
+import { LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode } from "./computeLambda.js";
 import { Ec2Compute } from "./computeEc2.js";
 // Re-export everything from per-pattern files
 export { 
 // ECS
 EcsCompute, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, resolveScalingConfig, 
 // Lambda
-LambdaCompute, resolveLambdaDeployment, Architecture, HttpMethod, InvokeMode, 
+LambdaCompute, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, 
 // EC2
 Ec2Compute };
 export const COMPUTE_TYPE_CONFIG = {
@@ -90,12 +91,20 @@ export function getComputeTypeConfig(type) {
  * TypeScript's compile-time checks may not apply.
  */
 function validateComputeProps(props) {
-    // ECS-specific options on non-ECS compute
-    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config", "services", "cluster"], "ecs", "ECS compute");
-    // Lambda-specific options on non-Lambda compute
-    warnIfPropertiesIgnored(props, ["functionUrl", "handler", "runtime"], "lambda", "Lambda compute");
-    // EC2-specific options on non-EC2 compute
-    warnIfPropertiesIgnored(props, ["ssh", "userData", "machineImage"], "ec2", "EC2 compute");
+    for (const group of COMPUTE_WARN_GROUPS) {
+        warnIfPropertiesIgnored(props, group.properties, group.applicableTypes, group.typeName);
+    }
+    // capacityProvider/ec2Config are EcsServiceConfig-level keys, not top-level
+    // EcsComputeProps, so the guard Record in computePropApplicability.ts would
+    // reject them — hand-curated misuse hints stay outside it.
+    warnIfPropertiesIgnored(props, ["capacityProvider", "ec2Config"], "ecs", "ECS compute");
+    if (props.type === "lambda") {
+        // warnIfPropertyIgnored reads only `.type` + presence, so a
+        // deployment-keyed view reuses the same machinery for the second axis.
+        const byDeployment = { ...props, type: props.deployment };
+        warnIfPropertiesIgnored(byDeployment, CONTAINER_LAMBDA_ONLY_PROPS, "container", "container-deployment Lambda", "deployment");
+        warnIfPropertiesIgnored(byDeployment, CODE_LAMBDA_ONLY_PROPS, "code", "code-deployment Lambda", "deployment");
+    }
     // ECS-specific validation - type narrowing handled by discriminated union
     if (props.type === "ecs") {
         validateEcsProps(props);
@@ -249,7 +258,7 @@ export class ComputeFactory {
                     if (lambdaComputeProps.deployment === "container" &&
                         lambdaComputeProps.docker !== undefined) {
                         manifestLambda.docker = lambdaComputeProps.docker;
-                        manifestLambda.imageKey = lambdaComputeProps.image ?? id;
+                        manifestLambda.imageKey = lambdaImageKey(lambdaComputeProps, id);
                     }
                     collector.addLambda(manifestLambda);
                     return new LambdaCompute(scope, id, lambdaComputeProps);

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -185,7 +185,9 @@ export interface CodeLambdaProps extends BaseLambdaProps {
  * Lambda compute configuration.
  *
  * Discriminated union ensuring type-safe Lambda configuration:
- * - `deployment: "container"` requires `ecrRepository`
+ * - `deployment: "container"` takes `ecrRepository` (bring-your-own image)
+ *   and/or `docker` (fjall builds and pushes; `ecrRepository` then defaults
+ *   to the app's shared default container registry)
  * - `deployment: "code"` requires `code` and allows `handler`/`runtime`
  *
  * @example
@@ -205,6 +207,18 @@ export interface ResolvedLambdaDeployment {
     handler: string;
     runtime: Runtime;
 }
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export declare function lambdaImageKey(props: {
+    image?: string;
+}, id: string): string;
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.

package/dist/lib/patterns/aws/computeLambda.js

@@ -10,6 +10,18 @@ import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab } from "@fjall/util";
 // Re-export Lambda types from CDK for user convenience
 export { Architecture, HttpMethod, InvokeMode } from "aws-cdk-lib/aws-lambda";
+/**
+ * Shared derivation of a container Lambda's image key. Consumed by both the
+ * synth-side CFN image-tag parameter (below) and the manifest `imageKey`
+ * (compute.ts) — `fjall deploy` matches manifest imageKey → built image tag →
+ * CFN parameter name, so the two derivations must stay byte-identical.
+ *
+ * An explicit empty-string `image` is treated as absent (falls back to `id`):
+ * `??` alone would let `image: ""` through as an empty build/tag key.
+ */
+export function lambdaImageKey(props, id) {
+    return props.image !== undefined && props.image !== "" ? props.image : id;
+}
 /**
  * Resolve Lambda deployment configuration from props.
  * Handles container vs code deployment types.
@@ -33,8 +45,12 @@ export function resolveLambdaDeployment(scope, id, props) {
             if (findings.length > 0) {
                 throw new Error(`Lambda '${id}': ${findings.map((f) => f.message).join(" ")}`);
             }
-            const tagKey = props.image ?? id;
-            const param = getOrCreateImageTagParameter(scope, tagKey);
+            const tagKey = lambdaImageKey(props, id);
+            const param = getOrCreateImageTagParameter(scope, tagKey, {
+                kind: "lambda-image",
+                declaredBy: id,
+                docker: props.docker
+            });
             return {
                 code: Code.fromEcrImage(props.ecrRepository, {
                     tagOrDigest: param.valueAsString

package/dist/lib/patterns/aws/computePropApplicability.d.ts

@@ -0,0 +1,20 @@
+import type { ComputeType } from "./interfaces/compute.js";
+import type { EcsComputeProps } from "./computeEcsTypes.js";
+import type { LambdaComputeProps } from "./computeLambda.js";
+import type { Ec2ComputeProps } from "./computeEc2.js";
+type KeysOfUnion<T> = T extends unknown ? keyof T : never;
+type AllComputePropKeys = keyof EcsComputeProps | KeysOfUnion<LambdaComputeProps> | keyof Ec2ComputeProps;
+export interface ComputeWarnGroup {
+    properties: string[];
+    applicableTypes: ComputeType[];
+    typeName: string;
+}
+export declare const COMPUTE_WARN_GROUPS: readonly ComputeWarnGroup[];
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export declare const ALL_COMPUTE_PROP_KEYS: AllComputePropKeys[];
+export declare const CONTAINER_LAMBDA_ONLY_PROPS: string[];
+export declare const CODE_LAMBDA_ONLY_PROPS: string[];
+export {};

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -0,0 +1,87 @@
+/**
+ * Compile-time lockstep guard for `validateComputeProps`'s ignored-prop
+ * warnings. The Record over the full top-level key union rejects BOTH a
+ * missing key (a new prop added to any compute props interface fails TS2741
+ * here until classified) and a stale extra key (a removed/renamed prop fails
+ * TS2353). `"all"` means the prop is legitimate on every compute type and
+ * never warns.
+ */
+const COMPUTE_PROP_APPLICABILITY = {
+    type: "all",
+    vpc: "all",
+    appName: ["ecs", "lambda"],
+    docker: ["ecs", "lambda"],
+    ecrRepository: ["ecs", "lambda"],
+    cluster: ["ecs"],
+    services: ["ecs"],
+    alertsTopic: ["ecs"],
+    applicationId: ["ecs"],
+    deployment: ["lambda"],
+    functionUrl: ["lambda"],
+    handler: ["lambda"],
+    runtime: ["lambda"],
+    code: ["lambda"],
+    image: ["lambda"],
+    timeout: ["lambda"],
+    memorySize: ["lambda"],
+    ephemeralStorageSize: ["lambda"],
+    architecture: ["lambda"],
+    description: ["lambda"],
+    roleDescription: ["lambda"],
+    inlinePolicy: ["lambda"],
+    environment: ["lambda"],
+    secrets: ["lambda"],
+    ssmSecretsPath: ["lambda"],
+    secretsImport: ["lambda"],
+    connections: ["lambda"],
+    instanceType: ["ec2"],
+    ssh: ["ec2"],
+    userData: ["ec2"],
+    machineImage: ["ec2"],
+    minCapacity: ["ec2"],
+    maxCapacity: ["ec2"],
+    spotCapacityPercentage: ["ec2"]
+};
+const TYPE_LABELS = {
+    ecs: "ECS",
+    lambda: "Lambda",
+    ec2: "EC2"
+};
+export const COMPUTE_WARN_GROUPS = (() => {
+    const groups = new Map();
+    for (const [prop, applicability] of Object.entries(COMPUTE_PROP_APPLICABILITY)) {
+        if (applicability === "all")
+            continue;
+        const key = applicability.join("+");
+        const existing = groups.get(key);
+        if (existing !== undefined) {
+            existing.properties.push(prop);
+        }
+        else {
+            groups.set(key, {
+                properties: [prop],
+                applicableTypes: [...applicability],
+                typeName: applicability.map((t) => TYPE_LABELS[t]).join(" or ") + " compute"
+            });
+        }
+    }
+    return [...groups.values()];
+})();
+/**
+ * Runtime key set for tests — derived from the compiled guard, never
+ * re-listed (typescript-standards § compile-time guards).
+ */
+export const ALL_COMPUTE_PROP_KEYS = Object.keys(COMPUTE_PROP_APPLICABILITY);
+const LAMBDA_DEPLOYMENT_APPLICABILITY = {
+    ecrRepository: "container",
+    docker: "container",
+    image: "container",
+    code: "code",
+    handler: "code",
+    runtime: "code"
+};
+const deploymentProps = (d) => Object.entries(LAMBDA_DEPLOYMENT_APPLICABILITY)
+    .filter(([, v]) => v === d)
+    .map(([k]) => k);
+export const CONTAINER_LAMBDA_ONLY_PROPS = deploymentProps("container");
+export const CODE_LAMBDA_ONLY_PROPS = deploymentProps("code");

package/dist/lib/patterns/aws/database.d.ts

@@ -28,7 +28,7 @@ export declare const DATABASE_ENGINE_CONFIG: Record<DatabaseEngine, {
     defaultUsername: string;
     sslParameters: Record<string, string>;
 }>;
-export declare function getAuroraClusterEngine(engine: DatabaseEngine): IClusterEngine;
+export declare function getAuroraClusterEngine(engine: DatabaseEngine, engineVersion?: string): IClusterEngine;
 export declare function getInstanceEngine(engine: DatabaseEngine): IInstanceEngine;
 export declare function getEngineConfig(engine: DatabaseEngine): EngineConfig;
 /**
@@ -59,6 +59,24 @@ export interface AuroraDatabaseProps extends BaseDatabaseProps {
     databaseEngine?: DatabaseEngine;
     /** Overrides databaseEngine if provided */
     engine?: IClusterEngine;
+    /**
+     * Aurora PostgreSQL version to build the engine at, e.g. `"16.6"`. Overrides
+     * the `databaseEngine` default version; ignored when `engine` is supplied.
+     * Required `>= 16.3` when `serverlessV2MinCapacity` is 0 (auto-pause floor).
+     */
+    engineVersion?: string;
+    /** Physical cluster identifier. Lower-cased; falls back to a derived name. */
+    clusterIdentifier?: string;
+    /** Physical name of the generated master-credentials secret. */
+    credentialsSecretName?: string;
+    /** Serverless-v2 floor in ACU. 0 enables scale-to-zero (auto-pause). */
+    serverlessV2MinCapacity?: number;
+    /** Serverless-v2 ceiling in ACU. */
+    serverlessV2MaxCapacity?: number;
+    /** Idle duration before an idle serverless-v2 cluster auto-pauses to 0 ACU. */
+    serverlessV2AutoPauseDuration?: Duration;
+    /** Enables the RDS Data API (HTTP endpoint) on the cluster. */
+    enableDataApi?: boolean;
     writer?: AuroraWriterConfig;
     readers?: AuroraReadersConfig | false;
     proxy?: ProxyConfig | false;

package/dist/lib/patterns/aws/database.js

@@ -57,8 +57,19 @@ const INSTANCE_ENGINE_FACTORIES = {
         });
     }
 };
-export function getAuroraClusterEngine(engine) {
-    return AURORA_ENGINE_FACTORIES[engine]();
+export function getAuroraClusterEngine(engine, engineVersion) {
+    if (engineVersion === undefined) {
+        return AURORA_ENGINE_FACTORIES[engine]();
+    }
+    // The auto-pause version floor is enforced in RdsAurora, alongside the
+    // min-capacity knob that requires it — not here.
+    if (engine !== "postgresql") {
+        throw new Error(`engineVersion override is only supported for postgresql Aurora clusters (received "${engine}")`);
+    }
+    const majorVersion = engineVersion.split(".")[0] ?? "16";
+    return DatabaseClusterEngine.auroraPostgres({
+        version: AuroraPostgresEngineVersion.of(engineVersion, majorVersion)
+    });
 }
 export function getInstanceEngine(engine) {
     return INSTANCE_ENGINE_FACTORIES[engine]();
@@ -346,7 +357,8 @@ export class RelationalDatabase extends Construct {
     }
     addAurora(props) {
         const resolvedDatabaseEngine = props.databaseEngine ?? "postgresql";
-        const resolvedEngine = props.engine ?? getAuroraClusterEngine(resolvedDatabaseEngine);
+        const resolvedEngine = props.engine ??
+            getAuroraClusterEngine(resolvedDatabaseEngine, props.engineVersion);
         const engineConfig = getEngineConfig(resolvedDatabaseEngine);
         if (props.publiclyAccessible) {
             FjallLogger.warn(`Aurora database '${props.databaseName}' is configured with public accessibility. ` +
@@ -356,7 +368,14 @@ export class RelationalDatabase extends Construct {
             vpc: props.vpc,
             databaseName: props.databaseName,
             engine: resolvedEngine,
+            engineVersion: props.engineVersion,
             engineConfig,
+            clusterIdentifier: props.clusterIdentifier,
+            credentialsSecretName: props.credentialsSecretName,
+            serverlessV2MinCapacity: props.serverlessV2MinCapacity,
+            serverlessV2MaxCapacity: props.serverlessV2MaxCapacity,
+            serverlessV2AutoPauseDuration: props.serverlessV2AutoPauseDuration,
+            enableDataApi: props.enableDataApi,
             writer: props.writer,
             readers: props.readers,
             proxy: props.proxy,