@fjall/components-infrastructure 2.30.3 → 2.32.0

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -11,3 +11,31 @@ export declare const RDS_DEFAULTS: Readonly<{
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */
     readonly DEFAULT_MAX_ALLOCATED_STORAGE_GIB: 500;
 }>;
+/**
+ * Serverless-v2 defaults for the internal dev substrate's shared Aurora cluster
+ * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
+ * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
+ * is the only mode under which min-0 actually saves (a live pooled connection
+ * pins the cluster above 0 ACU). Engine 16.6 satisfies the auto-pause-capable
+ * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`).
+ */
+export declare const DEV_AURORA_DEFAULTS: Readonly<{
+    readonly SERVERLESS_V2_MIN_CAPACITY: 0;
+    readonly SERVERLESS_V2_MAX_CAPACITY: 4;
+    readonly AUTO_PAUSE_SECONDS: 1200;
+    readonly ENABLE_DATA_API: true;
+    readonly ENGINE_VERSION: "16.6";
+}>;
+/**
+ * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`
+ * (5 minutes – 24 hours). A value outside this range synths but is rejected at
+ * deploy, so the resources layer validates it at synth instead.
+ */
+export declare const SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS = 300;
+export declare const SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS = 86400;
+/**
+ * Minimum Aurora PostgreSQL version that supports serverless-v2 auto-pause
+ * (`serverlessV2MinCapacity` 0). An explicit override below this synths clean
+ * but AccessDenies / rejects at deploy, so the resources layer hard-guards it.
+ */
+export declare const MIN_AUTO_PAUSE_POSTGRES_VERSION = "16.3";

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -11,3 +11,31 @@ export const RDS_DEFAULTS = Object.freeze({
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */
     DEFAULT_MAX_ALLOCATED_STORAGE_GIB: 500
 });
+/**
+ * Serverless-v2 defaults for the internal dev substrate's shared Aurora cluster
+ * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
+ * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
+ * is the only mode under which min-0 actually saves (a live pooled connection
+ * pins the cluster above 0 ACU). Engine 16.6 satisfies the auto-pause-capable
+ * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`).
+ */
+export const DEV_AURORA_DEFAULTS = Object.freeze({
+    SERVERLESS_V2_MIN_CAPACITY: 0,
+    SERVERLESS_V2_MAX_CAPACITY: 4,
+    AUTO_PAUSE_SECONDS: 1200,
+    ENABLE_DATA_API: true,
+    ENGINE_VERSION: "16.6"
+});
+/**
+ * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`
+ * (5 minutes – 24 hours). A value outside this range synths but is rejected at
+ * deploy, so the resources layer validates it at synth instead.
+ */
+export const SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS = 300;
+export const SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS = 86400;
+/**
+ * Minimum Aurora PostgreSQL version that supports serverless-v2 auto-pause
+ * (`serverlessV2MinCapacity` 0). An explicit override below this synths clean
+ * but AccessDenies / rejects at deploy, so the resources layer hard-guards it.
+ */
+export const MIN_AUTO_PAUSE_POSTGRES_VERSION = "16.3";

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -6,6 +6,7 @@ import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { Provider } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
 import { SingletonFunction } from "../../compute/lambda.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../../logging/logGroup.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Resolves relative to the compiled location too — the build step copies the
@@ -51,7 +52,10 @@ export class IdentityStoreUserProvider extends Construct {
             ]
         });
         const provider = new Provider(this, "Provider", {
-            onEventHandler: handler
+            onEventHandler: handler,
+            logGroup: new LogGroup(this, "ProviderLogGroup", {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         this.serviceToken = provider.serviceToken;
     }

package/dist/lib/resources/aws/logging/index.d.ts

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/index.js

@@ -1,2 +1,3 @@
 export * from "./cloudTrail.js";
 export * from "./logGroup.js";
+export * from "./singletonLogGroup.js";

package/dist/lib/resources/aws/logging/logGroup.d.ts

@@ -1,5 +1,12 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
 import { type Construct } from "constructs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export declare const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export declare class LogGroup extends Logs.LogGroup {
     constructor(scope: Construct, id: string, props?: Logs.LogGroupProps);
 }

package/dist/lib/resources/aws/logging/logGroup.js

@@ -1,4 +1,11 @@
 import * as Logs from "aws-cdk-lib/aws-logs";
+/**
+ * Default retention for framework-owned lambda log groups. Coupled across
+ * every framework lambda construct (LambdaFunction, SingletonFunction, the
+ * custom-resource Provider groups, and the stack-singleton groups) — drift
+ * would silently give sibling framework lambdas different retention.
+ */
+export const DEFAULT_FRAMEWORK_LOG_RETENTION = Logs.RetentionDays.ONE_WEEK;
 export class LogGroup extends Logs.LogGroup {
     constructor(scope, id, props) {
         super(scope, id, props);

package/dist/lib/resources/aws/logging/singletonLogGroup.d.ts

@@ -0,0 +1,15 @@
+import { type Construct } from "constructs";
+import { LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export declare function stackSingletonLogGroup(scope: Construct, purpose: "AwsCustomResource" | "BucketDeployment"): LogGroup;

package/dist/lib/resources/aws/logging/singletonLogGroup.js

@@ -0,0 +1,24 @@
+import { Stack } from "aws-cdk-lib";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "./logGroup.js";
+/**
+ * Returns the stack-scoped shared LogGroup for a family of framework lambdas
+ * that CDK dedupes to one function per stack (AwsCustomResource's AWS679f…
+ * singleton, BucketDeployment's custom-resource handler). Every call site in
+ * the stack MUST hand the singleton lambda the SAME log group — CDK applies
+ * the first instantiation's props and silently ignores later ones, which
+ * would leave per-site groups synthesised but unused.
+ *
+ * The group is nameless (CDK-generated name), so it never collides with the
+ * `/aws/lambda/<fn>` group the Lambda service auto-created on existing
+ * deployments; the auto-created group simply stops receiving logs.
+ */
+export function stackSingletonLogGroup(scope, purpose) {
+    const stack = Stack.of(scope);
+    const id = `Fjall${purpose}LogGroup`;
+    const existing = stack.node.tryFindChild(id);
+    if (existing !== undefined)
+        return existing;
+    return new LogGroup(stack, id, {
+        retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+    });
+}

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -2,8 +2,9 @@ import { Construct } from "constructs";
 import { Stack, Tags } from "aws-cdk-lib";
 import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
-import { AwsCustomResource, AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
     peeringConnectionId;

package/dist/lib/resources/aws/storage/bucketDeployment.d.ts

@@ -3,12 +3,11 @@ import { type Construct } from "constructs";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
  *
- * Currently a thin pass-through — no defaults are applied today. The wrapper
- * exists so that future SOC2 / compliance defaults (tags, retention, encryption
- * on the underlying Lambda + Custom Resource) reach every consumer in one edit.
- * Per `.claude/rules/generator-standards.md § Wrapper Routing Discipline` and
- * `patterns/infrastructure-wrapper-routing-pattern.md § A3` ("a wrapper that
- * is a thin pass-through today is still the routing point"), `lib/{config,
+ * Applies one default: an explicit, stack-shared log group for the deployment
+ * handler lambda, so it is CloudFormation-managed and tagged rather than
+ * service-auto-created. Per `.claude/rules/generator-standards.md § Wrapper
+ * Routing Discipline` and
+ * `patterns/infrastructure-wrapper-routing-pattern.md § A3`, `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
  */
 export declare class BucketDeployment extends CdkBucketDeployment {

package/dist/lib/resources/aws/storage/bucketDeployment.js

@@ -1,17 +1,24 @@
 import { BucketDeployment as CdkBucketDeployment } from "aws-cdk-lib/aws-s3-deployment";
+import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
  *
- * Currently a thin pass-through — no defaults are applied today. The wrapper
- * exists so that future SOC2 / compliance defaults (tags, retention, encryption
- * on the underlying Lambda + Custom Resource) reach every consumer in one edit.
- * Per `.claude/rules/generator-standards.md § Wrapper Routing Discipline` and
- * `patterns/infrastructure-wrapper-routing-pattern.md § A3` ("a wrapper that
- * is a thin pass-through today is still the routing point"), `lib/{config,
+ * Applies one default: an explicit, stack-shared log group for the deployment
+ * handler lambda, so it is CloudFormation-managed and tagged rather than
+ * service-auto-created. Per `.claude/rules/generator-standards.md § Wrapper
+ * Routing Discipline` and
+ * `patterns/infrastructure-wrapper-routing-pattern.md § A3`, `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
  */
 export class BucketDeployment extends CdkBucketDeployment {
     constructor(scope, id, props) {
-        super(scope, id, props);
+        super(scope, id, {
+            ...props,
+            // CDK dedupes the deployment handler to one lambda per stack (per
+            // memory/vpc variant), so the explicit log group must be the
+            // stack-shared one — a per-site group would only bind for whichever
+            // site instantiates first.
+            logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "BucketDeployment")
+        });
     }
 }

package/dist/lib/resources/aws/utilities/awsCustomResource.js

@@ -1,9 +1,14 @@
 import * as customResource from "aws-cdk-lib/custom-resources";
+import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 export class AwsCustomResource extends customResource.AwsCustomResource {
     response;
     constructor(scope, id, props) {
         super(scope, id, {
             ...props,
+            // Every AwsCustomResource in a stack shares CDK's one singleton lambda,
+            // so the explicit log group must be the stack-shared one — a per-site
+            // group would only bind for whichever site instantiates first.
+            logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "AwsCustomResource"),
             policy: props.policy ||
                 customResource.AwsCustomResourcePolicy.fromSdkCalls({
                     resources: customResource.AwsCustomResourcePolicy.ANY_RESOURCE

package/dist/lib/resources/aws/utilities/customResource.js

@@ -4,6 +4,7 @@ import { Code } from "aws-cdk-lib/aws-lambda";
 import { Construct } from "constructs";
 import { SingletonFunction, LambdaFunction } from "../compute/lambda.js";
 import { DEFAULT_CUSTOM_RESOURCE_TIMEOUT_SECONDS } from "../compute/ecsConstants.js";
+import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
 export class CustomResource extends Construct {
     response;
     resource;
@@ -54,7 +55,10 @@ export class CustomResource extends Construct {
                 inlinePolicy: props.inlinePolicy
             });
         const provider = new Provider(this, `${id}Provider`, {
-            onEventHandler: lambdaFunction
+            onEventHandler: lambdaFunction,
+            logGroup: new LogGroup(this, `${id}ProviderLogGroup`, {
+                retention: DEFAULT_FRAMEWORK_LOG_RETENTION
+            })
         });
         this.resource = new customResource(this, `${id}Resource`, {
             serviceToken: provider.serviceToken,

package/dist/lib/utils/addSuffixToEmail.js

@@ -1,7 +1,3 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = addSuffixToEmail;
-function addSuffixToEmail(email, suffix) {
+export default function addSuffixToEmail(email, suffix) {
     return email.replace("@", `+${suffix}@`);
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWRkU3VmZml4VG9FbWFpbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL2xpYi91dGlscy9hZGRTdWZmaXhUb0VtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsbUNBS0M7QUFMRCxTQUF3QixnQkFBZ0IsQ0FDdEMsS0FBYSxFQUNiLE1BQWM7SUFFZCxPQUFPLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztBQUMzQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiZXhwb3J0IGRlZmF1bHQgZnVuY3Rpb24gYWRkU3VmZml4VG9FbWFpbChcbiAgZW1haWw6IHN0cmluZyxcbiAgc3VmZml4OiBzdHJpbmdcbik6IHN0cmluZyB7XG4gIHJldHVybiBlbWFpbC5yZXBsYWNlKFwiQFwiLCBgKyR7c3VmZml4fUBgKTtcbn1cbiJdfQ==

package/dist/lib/utils/devSubstrateTags.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Tags applied by the internal `DevSubstrate` construct.
+ *
+ * `fjall:dev = "true"` is IAM-load-bearing, not cosmetic. The shipped dev-tier
+ * deploy fence in `@fjall/generator` (`src/schemas/devRolePolicies.ts`) gates its
+ * slot-ops grants on `aws:ResourceTag/fjall:dev = "true"` and
+ * `aws:RequestTag/fjall:dev = "true"`. The key and value here MUST stay
+ * byte-identical to those IAM condition keys — any drift silently unfences the
+ * substrate (the runtime-name-must-match-construct coupling class).
+ *
+ * A util-level single source shared with the policy is a candidate follow-up; it
+ * is deliberately NOT folded here, to avoid editing the parity-locked security
+ * policy from a construct-scaffold change.
+ */
+export declare const DEV_TAG_KEY: "fjall:dev";
+export declare const DEV_TAG_VALUE: "true";
+/**
+ * Reaper / organisational-mapping tag carrying the real customer application id
+ * (distinct from the `fjall-dev-<app>` CDK App identity that drives the
+ * substrate's stack names). NOT part of the IAM fence contract.
+ */
+export declare const DEV_APP_TAG_KEY: "fjall:app";

package/dist/lib/utils/devSubstrateTags.js

@@ -0,0 +1,22 @@
+/**
+ * Tags applied by the internal `DevSubstrate` construct.
+ *
+ * `fjall:dev = "true"` is IAM-load-bearing, not cosmetic. The shipped dev-tier
+ * deploy fence in `@fjall/generator` (`src/schemas/devRolePolicies.ts`) gates its
+ * slot-ops grants on `aws:ResourceTag/fjall:dev = "true"` and
+ * `aws:RequestTag/fjall:dev = "true"`. The key and value here MUST stay
+ * byte-identical to those IAM condition keys — any drift silently unfences the
+ * substrate (the runtime-name-must-match-construct coupling class).
+ *
+ * A util-level single source shared with the policy is a candidate follow-up; it
+ * is deliberately NOT folded here, to avoid editing the parity-locked security
+ * policy from a construct-scaffold change.
+ */
+export const DEV_TAG_KEY = "fjall:dev";
+export const DEV_TAG_VALUE = "true";
+/**
+ * Reaper / organisational-mapping tag carrying the real customer application id
+ * (distinct from the `fjall-dev-<app>` CDK App identity that drives the
+ * substrate's stack names). NOT part of the IAM fence contract.
+ */
+export const DEV_APP_TAG_KEY = "fjall:app";

package/dist/lib/utils/validationLogger.d.ts

@@ -24,11 +24,11 @@ export declare const FjallLogger: {
  */
 export declare function warnIfPropertyIgnored<T extends {
     type: string;
-}>(props: T, property: string, applicableType: string | string[], typeName: string): void;
+}>(props: T, property: string, applicableType: string | string[], typeName: string, discriminatorLabel?: string): void;
 /**
  * Warn if any of the specified properties are set but will be ignored.
  * Convenience wrapper for checking multiple properties at once.
  */
 export declare function warnIfPropertiesIgnored<T extends {
     type: string;
-}>(props: T, properties: string[], applicableType: string | string[], typeName: string): void;
+}>(props: T, properties: string[], applicableType: string | string[], typeName: string, discriminatorLabel?: string): void;

package/dist/lib/utils/validationLogger.js

@@ -57,7 +57,7 @@ export const FjallLogger = {
  * @param applicableType - The type(s) where this property is used
  * @param typeName - Human-readable type name for the message
  */
-export function warnIfPropertyIgnored(props, property, applicableType, typeName) {
+export function warnIfPropertyIgnored(props, property, applicableType, typeName, discriminatorLabel = "type") {
     const propsRecord = props;
     const types = Array.isArray(applicableType)
         ? applicableType
@@ -66,15 +66,15 @@ export function warnIfPropertyIgnored(props, property, applicableType, typeName)
         property in propsRecord &&
         propsRecord[property] !== undefined) {
         FjallLogger.warn(`'${property}' is only used for ${typeName} type. ` +
-            `It will be ignored for type '${props.type}'.`);
+            `It will be ignored for ${discriminatorLabel} '${props.type}'.`);
     }
 }
 /**
  * Warn if any of the specified properties are set but will be ignored.
  * Convenience wrapper for checking multiple properties at once.
  */
-export function warnIfPropertiesIgnored(props, properties, applicableType, typeName) {
+export function warnIfPropertiesIgnored(props, properties, applicableType, typeName, discriminatorLabel = "type") {
     for (const property of properties) {
-        warnIfPropertyIgnored(props, property, applicableType, typeName);
+        warnIfPropertyIgnored(props, property, applicableType, typeName, discriminatorLabel);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.30.3",
+  "version": "2.32.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs",
     "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.30.3",
-    "@fjall/util": "^2.30.3",
+    "@fjall/generator": "^2.32.0",
+    "@fjall/util": "^2.32.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "d398edc0c0edf661d7ab6e5a47623529f68dfd2a"
+  "gitHead": "876a79a9ad0031a5919019c86867c28c1ab9dc92"
 }

package/dist/lib/__tests__/setup.d.ts

@@ -1,48 +0,0 @@
-import { App } from "aws-cdk-lib";
-import { Template } from "aws-cdk-lib/assertions";
-import { Stack } from "aws-cdk-lib";
-/**
- * Test utilities for CDK infrastructure testing
- */
-export declare class TestUtils {
-    /**
-     * Create a test app with proper environment settings
-     */
-    static createTestApp(): App;
-    /**
-     * Create a test stack within a test app
-     */
-    static createTestStack(app?: App): Stack;
-    /**
-     * Get CloudFormation template from a stack for assertions
-     */
-    static getTemplate(stack: Stack): Template;
-    /**
-     * Generate consistent snapshot from CDK stack
-     */
-    static getSnapshotTemplate(stack: Stack): any;
-    /**
-     * Clean up template for consistent snapshots by removing random IDs
-     */
-    static sanitiseTemplate(template: any): any;
-}
-/**
- * Common test data for infrastructure patterns
- */
-export declare const TestData: {
-    defaultTags: {
-        "fjall:costAllocation:environment": string;
-        "fjall:costAllocation:owner": string;
-    };
-    defaultAccountId: string;
-    defaultRegion: string;
-    vpc: {
-        vpcId: string;
-    };
-    basicApp: {
-        serviceName: string;
-        environment: string;
-        containerPort: number;
-        owner: string;
-    };
-};