@fjall/components-infrastructure 2.31.1 → 2.32.0

package/dist/lib/resources/aws/compute/ecsRoles.js

@@ -2,12 +2,22 @@ import { Stack } from "aws-cdk-lib";
 import { Effect, Policy, PolicyStatement, Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { deriveSsmSecretsPath } from "./ecsTaskDefinition.js";
 /**
- * Creates the execution role for ECS infrastructure operations.
- * Used by the ECS agent to pull images, write logs, and inject secrets.
- * NOT used by application code — that's the task role.
+ * Builds the base ECS task-execution role shared by every task the platform
+ * runs: the ECR-pull quartet (account-level, so `resources: ["*"]`) and a
+ * ViaService-conditioned `kms:Decrypt` for SSM SecureString / Secrets-Manager
+ * CMK env injection. Pass `ssmSecretsPath` (already derived — no partition/
+ * region/account prefix) to add the path-scoped `ssm:GetParameters` grant.
+ * Trust principal is `ecs-tasks.amazonaws.com`.
+ *
+ * Deliberately omits `logs:*` and `secretsmanager:GetSecretValue`: on the
+ * ECS-pattern path `AwsLogDriver.bind()` and `addContainer({ secrets })`
+ * auto-grant those on the exact LogGroup / secret ARNs. A caller that builds a
+ * SHARED or IMPORTED role those auto-grants cannot reach — e.g. the dev
+ * substrate's slot exec role, referenced by slot task-defs via ARN — MUST add
+ * the explicit `logs` / `secretsmanager` statements itself.
  */
-export function createExecutionRole(ctx, serviceName) {
-    const executionRole = new Role(ctx.scope, `${serviceName}ExecutionRole`, {
+export function createBaseExecutionRole(scope, id, opts = {}) {
+    const executionRole = new Role(scope, id, {
         assumedBy: new ServicePrincipal("ecs-tasks.amazonaws.com")
     });
     // GetAuthorizationToken is an account-level API that requires resources: ["*"].
@@ -23,25 +33,13 @@ export function createExecutionRole(ctx, serviceName) {
         ],
         resources: ["*"]
     }));
-    const { partition, region, account } = Stack.of(ctx.scope);
-    // Gotcha: no manual logs grant here. The task definition's AwsLogDriver
-    // binds an explicit LogGroup construct (CFN auto-named — there is NO
-    // `/ecs/{cluster}/...` group; that shape is only the stream prefix), and
-    // `AwsLogDriver.bind()` auto-grants CreateLogStream/PutLogEvents on the
-    // real group's ARN. A hand-rolled `/ecs/{cluster}*` statement grants
-    // access to log groups that do not exist.
-    // Gotcha: do NOT add a manual `secretsImport` grant here. `addContainer({ secrets })`
-    // auto-grants `secret.grantRead(executionRole)` on the resolved complete ARN (exact, no
-    // wildcard). A manual bare/`-*` statement is the 2026-06-04 outage shape and is dead.
-    const serviceProps = ctx.props.services.find((s) => s.name === serviceName);
-    const hasSsmSecrets = serviceProps?.containers.some((container) => container.secrets && container.secrets.length > 0) ?? false;
-    if (hasSsmSecrets && serviceProps) {
-        const ssmPath = deriveSsmSecretsPath(ctx.props, serviceName, serviceProps.ssmSecretsPath);
+    const { partition, region, account } = Stack.of(scope);
+    if (opts.ssmSecretsPath !== undefined) {
         executionRole.addToPolicy(new PolicyStatement({
             effect: Effect.ALLOW,
             actions: ["ssm:GetParameters", "ssm:GetParameter"],
             resources: [
-                `arn:${partition}:ssm:${region}:${account}:parameter${ssmPath}/*`
+                `arn:${partition}:ssm:${region}:${account}:parameter${opts.ssmSecretsPath}/*`
             ]
         }));
     }
@@ -61,6 +59,27 @@ export function createExecutionRole(ctx, serviceName) {
     }));
     return executionRole;
 }
+/**
+ * Creates the execution role for ECS infrastructure operations.
+ * Used by the ECS agent to pull images, write logs, and inject secrets.
+ * NOT used by application code — that's the task role.
+ *
+ * Delegates the ECR/kms/ssm shape to `createBaseExecutionRole`. Logs +
+ * secretsmanager are auto-granted downstream on this path (AwsLogDriver.bind()
+ * on the real LogGroup, addContainer({ secrets }) on the exact secret ARN), so a
+ * hand-rolled `/ecs/{cluster}*` logs or bare `-*` secrets statement here would be
+ * dead (the 2026-06-04 outage shape).
+ */
+export function createExecutionRole(ctx, serviceName) {
+    const serviceProps = ctx.props.services.find((s) => s.name === serviceName);
+    const hasSsmSecrets = serviceProps?.containers.some((container) => container.secrets && container.secrets.length > 0) ?? false;
+    const ssmSecretsPath = hasSsmSecrets && serviceProps
+        ? deriveSsmSecretsPath(ctx.props, serviceName, serviceProps.ssmSecretsPath)
+        : undefined;
+    return createBaseExecutionRole(ctx.scope, `${serviceName}ExecutionRole`, {
+        ssmSecretsPath
+    });
+}
 /**
  * Creates the task role for application code running in the container.
  * This role is assumed by the application, not the ECS agent.

package/dist/lib/resources/aws/compute/hostHeaderListenerRule.d.ts

@@ -0,0 +1,23 @@
+import { ListenerCondition } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { EcsRoutingConfig } from "./ecsTypes.js";
+/**
+ * Mutable ALB rule-priority state shared across every rule on one listener. The
+ * ECS cluster path and the dev substrate both thread a single instance so
+ * auto-incremented and host-hashed priorities never collide on the same listener.
+ */
+export interface PriorityState {
+    nextPriority: number;
+    usedPriorities: Set<number>;
+}
+/** Returns the next unused auto-incremented ALB priority, skipping any manually assigned values. */
+export declare function getNextPriority(state: PriorityState): number;
+export declare function buildRoutingConditions(rule: EcsRoutingConfig | undefined): ListenerCondition[];
+/**
+ * A deterministic, in-band ALB rule priority for a host-routed slot rule. Same
+ * host → same priority across synths. Collisions (two hosts hashing equal, a
+ * host re-registering, or a manually-claimed priority) are resolved by
+ * open-addressing linear probe with wraparound within the band, claimed against
+ * the shared `usedPriorities`. Throws only if the (40 000-slot) band is exhausted
+ * — unreachable in practice given AWS's per-listener rule ceiling.
+ */
+export declare function deterministicHostPriority(host: string, state: PriorityState): number;

package/dist/lib/resources/aws/compute/hostHeaderListenerRule.js

@@ -0,0 +1,59 @@
+import { ListenerCondition } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+/** Returns the next unused auto-incremented ALB priority, skipping any manually assigned values. */
+export function getNextPriority(state) {
+    while (state.usedPriorities.has(state.nextPriority)) {
+        state.nextPriority++;
+    }
+    const priority = state.nextPriority++;
+    state.usedPriorities.add(priority);
+    return priority;
+}
+export function buildRoutingConditions(rule) {
+    const conditions = [];
+    if (rule?.path) {
+        conditions.push(ListenerCondition.pathPatterns([rule.path]));
+    }
+    if (rule?.host) {
+        conditions.push(ListenerCondition.hostHeaders([rule.host]));
+    }
+    return conditions;
+}
+// ALB rule priorities are 1..50000 and unique per listener. Host-hashed slot
+// rules occupy a band DISJOINT from the auto-increment counter (which starts at
+// 100 and climbs — realistically a few hundred at most), so a deterministic slot
+// priority can never collide with an ECS-service rule that shares the same
+// PriorityState. Band [10000, 49999] sits above the counter and below the 50000 max.
+const HOST_PRIORITY_BAND_START = 10_000;
+const HOST_PRIORITY_BAND_SIZE = 40_000;
+/**
+ * FNV-1a 32-bit string hash. Deterministic across processes and machines (no
+ * Math.random / Date), so the same host maps to the same base priority on every
+ * synth — stable rule ordering, no spurious CloudFormation diffs.
+ */
+function fnv1a32(input) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < input.length; i++) {
+        hash ^= input.charCodeAt(i);
+        hash = Math.imul(hash, 0x0100_0193);
+    }
+    return hash >>> 0;
+}
+/**
+ * A deterministic, in-band ALB rule priority for a host-routed slot rule. Same
+ * host → same priority across synths. Collisions (two hosts hashing equal, a
+ * host re-registering, or a manually-claimed priority) are resolved by
+ * open-addressing linear probe with wraparound within the band, claimed against
+ * the shared `usedPriorities`. Throws only if the (40 000-slot) band is exhausted
+ * — unreachable in practice given AWS's per-listener rule ceiling.
+ */
+export function deterministicHostPriority(host, state) {
+    const base = fnv1a32(host) % HOST_PRIORITY_BAND_SIZE;
+    for (let probe = 0; probe < HOST_PRIORITY_BAND_SIZE; probe++) {
+        const priority = HOST_PRIORITY_BAND_START + ((base + probe) % HOST_PRIORITY_BAND_SIZE);
+        if (!state.usedPriorities.has(priority)) {
+            state.usedPriorities.add(priority);
+            return priority;
+        }
+    }
+    throw new Error(`Exhausted the host-priority band resolving a priority for "${host}"`);
+}

package/dist/lib/resources/aws/compute/lambdaAlbTarget.d.ts

@@ -0,0 +1,17 @@
+import { type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { IFunction } from "aws-cdk-lib/aws-lambda";
+import type { Construct } from "constructs";
+export interface LambdaAlbTargetOptions {
+    readonly handler: IFunction;
+}
+/**
+ * Context-free Lambda-behind-ALB target group. Registering the handler as a
+ * `LambdaTarget` auto-adds the `elasticloadbalancing.amazonaws.com` invoke
+ * permission (CDK's `LambdaTarget.attachToApplicationTargetGroup` → `grantInvoke`),
+ * so no explicit `AWS::Lambda::Permission` is needed.
+ *
+ * Intentionally NOT attached to a listener here — the substrate exports the
+ * target-group ARN (A7) so slot-ops point a sleeping slot's host-header rule at
+ * it (§5.4); an unmatched host still falls through to the listener's 404.
+ */
+export declare function createLambdaTargetGroup(scope: Construct, id: string, options: LambdaAlbTargetOptions): IApplicationTargetGroup;

package/dist/lib/resources/aws/compute/lambdaAlbTarget.js

@@ -0,0 +1,18 @@
+import { ApplicationTargetGroup, TargetType } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { LambdaTarget } from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
+/**
+ * Context-free Lambda-behind-ALB target group. Registering the handler as a
+ * `LambdaTarget` auto-adds the `elasticloadbalancing.amazonaws.com` invoke
+ * permission (CDK's `LambdaTarget.attachToApplicationTargetGroup` → `grantInvoke`),
+ * so no explicit `AWS::Lambda::Permission` is needed.
+ *
+ * Intentionally NOT attached to a listener here — the substrate exports the
+ * target-group ARN (A7) so slot-ops point a sleeping slot's host-header rule at
+ * it (§5.4); an unmatched host still falls through to the listener's 404.
+ */
+export function createLambdaTargetGroup(scope, id, options) {
+    return new ApplicationTargetGroup(scope, id, {
+        targetType: TargetType.LAMBDA,
+        targets: [new LambdaTarget(options.handler)]
+    });
+}

package/dist/lib/resources/aws/compute/listenerRouting.d.ts

@@ -0,0 +1,21 @@
+import { type ApplicationListener, type ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
+export interface RoutingListenerOptions {
+    readonly port: number;
+    readonly certificate?: ICertificate;
+    /**
+     * Attach a fixed 404 default action. The ECS path passes this conditionally
+     * (only when ≥2 routes exist or no service has a port — CDK rejects a listener
+     * with neither a default action nor target groups); the dev substrate passes
+     * `true` unconditionally, since its host-header rules are the only routes and
+     * an unmatched host must return 404, not fall through.
+     */
+    readonly default404: boolean;
+}
+/**
+ * Context-free ALB listener factory shared by the ECS cluster path and the dev
+ * substrate. When `default404` is set, the listener's default action is a plain
+ * `404 Not Found` fixed response; otherwise no default action is attached (the
+ * caller's target groups become the listener's default).
+ */
+export declare function addRoutingListener(loadBalancer: ApplicationLoadBalancer, id: string, options: RoutingListenerOptions): ApplicationListener;

package/dist/lib/resources/aws/compute/listenerRouting.js

@@ -0,0 +1,20 @@
+import { ListenerAction } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+/**
+ * Context-free ALB listener factory shared by the ECS cluster path and the dev
+ * substrate. When `default404` is set, the listener's default action is a plain
+ * `404 Not Found` fixed response; otherwise no default action is attached (the
+ * caller's target groups become the listener's default).
+ */
+export function addRoutingListener(loadBalancer, id, options) {
+    const defaultAction = options.default404
+        ? ListenerAction.fixedResponse(404, {
+            contentType: "text/plain",
+            messageBody: "Not Found"
+        })
+        : undefined;
+    return loadBalancer.addListener(id, {
+        port: options.port,
+        ...(options.certificate && { certificates: [options.certificate] }),
+        ...(defaultAction !== undefined && { defaultAction })
+    });
+}

package/dist/lib/resources/aws/database/rdsAurora.d.ts

@@ -10,8 +10,24 @@ interface RdsProps {
     vpc: IVpc;
     databaseName?: string;
     engine?: IClusterEngine;
+    /**
+     * Aurora PostgreSQL version string the `engine` was built at, carried purely
+     * so the auto-pause floor can be validated here (the layer that owns the
+     * min-capacity knob). `undefined` means the engine default (>= 16.3) is in use.
+     */
+    engineVersion?: string;
     engineConfig?: EngineConfig;
     clusterIdentifier?: string;
+    /** Physical name of the generated master-credentials secret. */
+    credentialsSecretName?: string;
+    /** Serverless-v2 floor in ACU. 0 enables scale-to-zero (auto-pause). */
+    serverlessV2MinCapacity?: number;
+    /** Serverless-v2 ceiling in ACU. */
+    serverlessV2MaxCapacity?: number;
+    /** Idle duration before an idle serverless-v2 cluster auto-pauses to 0 ACU. */
+    serverlessV2AutoPauseDuration?: Duration;
+    /** Enables the RDS Data API (HTTP endpoint) on the cluster. */
+    enableDataApi?: boolean;
     writer?: AuroraWriterConfig;
     readers?: AuroraReadersConfig | false;
     proxy?: ProxyConfig | false;

package/dist/lib/resources/aws/database/rdsAurora.js

@@ -8,10 +8,49 @@ import { Secret } from "../secrets/index.js";
 import { ResourceNaming } from "../../../utils/resourceNaming.js";
 import { addProxyCfnOutput } from "./rdsProxyOutput.js";
 import { getDatabaseInsightsRetention } from "./index.js";
-import { RDS_DEFAULTS } from "./rdsDefaults.js";
+import { RDS_DEFAULTS, SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS, SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS, MIN_AUTO_PAUSE_POSTGRES_VERSION } from "./rdsDefaults.js";
 import { createRdsAlarms } from "../monitoring/index.js";
 import { DEFAULT_POSTGRES_ENGINE_CONFIG, resolveDatabaseInsights, resolveStorageEncryptionKey, resolvePerformanceInsightsKey, addMultiUserSecretRotation, warnIfSnapshotUsernameAssumed } from "./rdsHelpers.js";
 import { resolveSecretRotation } from "../../../utils/databaseTypes.js";
+function parsePostgresVersion(version) {
+    const parts = version.split(".");
+    return {
+        major: parseInt(parts[0] ?? "", 10),
+        minor: parseInt(parts[1] ?? "0", 10)
+    };
+}
+function assertAutoPauseCapablePostgresVersion(engineVersion) {
+    const { major, minor } = parsePostgresVersion(engineVersion);
+    if (Number.isNaN(major) || Number.isNaN(minor)) {
+        throw new Error(`Invalid Aurora engineVersion "${engineVersion}" (expected "<major>.<minor>")`);
+    }
+    const floor = parsePostgresVersion(MIN_AUTO_PAUSE_POSTGRES_VERSION);
+    const meetsFloor = major > floor.major || (major === floor.major && minor >= floor.minor);
+    if (!meetsFloor) {
+        throw new Error(`serverlessV2MinCapacity 0 requires Aurora PostgreSQL >= ${MIN_AUTO_PAUSE_POSTGRES_VERSION} for auto-pause; received engineVersion "${engineVersion}"`);
+    }
+}
+function validateServerlessV2DevKnobs(props) {
+    const min = props.serverlessV2MinCapacity;
+    const max = props.serverlessV2MaxCapacity;
+    if (min !== undefined && max !== undefined && min > max) {
+        throw new Error(`serverlessV2MinCapacity (${min}) must be <= serverlessV2MaxCapacity (${max})`);
+    }
+    if (props.serverlessV2AutoPauseDuration !== undefined) {
+        const seconds = props.serverlessV2AutoPauseDuration.toSeconds();
+        if (seconds < SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS ||
+            seconds > SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS) {
+            throw new Error(`serverlessV2AutoPauseDuration must be between ${SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS}s and ${SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS}s; received ${seconds}s`);
+        }
+    }
+    // Floor enforced only via engineVersion (opaque `IClusterEngine` can't be
+    // introspected): a raw `engine` below the floor with min 0 and no version is
+    // the caller's own risk. No such caller exists — DevSubstrate always passes
+    // engineVersion.
+    if (min === 0 && props.engineVersion !== undefined) {
+        assertAutoPauseCapablePostgresVersion(props.engineVersion);
+    }
+}
 export class RdsAurora extends Construct {
     connections;
     constructId;
@@ -25,6 +64,7 @@ export class RdsAurora extends Construct {
     databaseNameValue;
     constructor(scope, id, props) {
         super(scope, id);
+        validateServerlessV2DevKnobs(props);
         this.constructId = id;
         this.databaseNameValue = props.databaseName ?? id;
         // PostgreSQL fallback for direct usage - ensure engine and engineConfig match
@@ -44,7 +84,8 @@ export class RdsAurora extends Construct {
         // Global secondary clusters import replicated secret instead of creating new
         if (props.isGlobalSecondary) {
             this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
-                secretName: ResourceNaming.credentialsSecretName(id),
+                secretName: props.credentialsSecretName ??
+                    ResourceNaming.credentialsSecretName(id),
                 importExisting: true
             });
         }
@@ -57,7 +98,8 @@ export class RdsAurora extends Construct {
                 assumedUsername: username
             });
             this.databaseCredentials = new Secret(this, `${this.databaseNameValue}Credentials`, {
-                secretName: ResourceNaming.credentialsSecretName(id),
+                secretName: props.credentialsSecretName ??
+                    ResourceNaming.credentialsSecretName(id),
                 generateSecretString: {
                     secretStringTemplate: JSON.stringify({ username }),
                     excludePunctuation: true,
@@ -140,6 +182,18 @@ export class RdsAurora extends Construct {
             removalPolicy: RemovalPolicy.SNAPSHOT,
             deletionProtection: props.deletionProtection ?? true,
             iamAuthentication: true,
+            ...(props.serverlessV2MinCapacity !== undefined && {
+                serverlessV2MinCapacity: props.serverlessV2MinCapacity
+            }),
+            ...(props.serverlessV2MaxCapacity !== undefined && {
+                serverlessV2MaxCapacity: props.serverlessV2MaxCapacity
+            }),
+            ...(props.serverlessV2AutoPauseDuration !== undefined && {
+                serverlessV2AutoPauseDuration: props.serverlessV2AutoPauseDuration
+            }),
+            ...(props.enableDataApi !== undefined && {
+                enableDataApi: props.enableDataApi
+            }),
             writer,
             readers
         };

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -11,3 +11,31 @@ export declare const RDS_DEFAULTS: Readonly<{
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */
     readonly DEFAULT_MAX_ALLOCATED_STORAGE_GIB: 500;
 }>;
+/**
+ * Serverless-v2 defaults for the internal dev substrate's shared Aurora cluster
+ * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
+ * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
+ * is the only mode under which min-0 actually saves (a live pooled connection
+ * pins the cluster above 0 ACU). Engine 16.6 satisfies the auto-pause-capable
+ * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`).
+ */
+export declare const DEV_AURORA_DEFAULTS: Readonly<{
+    readonly SERVERLESS_V2_MIN_CAPACITY: 0;
+    readonly SERVERLESS_V2_MAX_CAPACITY: 4;
+    readonly AUTO_PAUSE_SECONDS: 1200;
+    readonly ENABLE_DATA_API: true;
+    readonly ENGINE_VERSION: "16.6";
+}>;
+/**
+ * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`
+ * (5 minutes – 24 hours). A value outside this range synths but is rejected at
+ * deploy, so the resources layer validates it at synth instead.
+ */
+export declare const SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS = 300;
+export declare const SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS = 86400;
+/**
+ * Minimum Aurora PostgreSQL version that supports serverless-v2 auto-pause
+ * (`serverlessV2MinCapacity` 0). An explicit override below this synths clean
+ * but AccessDenies / rejects at deploy, so the resources layer hard-guards it.
+ */
+export declare const MIN_AUTO_PAUSE_POSTGRES_VERSION = "16.3";

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -11,3 +11,31 @@ export const RDS_DEFAULTS = Object.freeze({
     /** Default storage autoscaling ceiling (GiB) — applied to primary and replica */
     DEFAULT_MAX_ALLOCATED_STORAGE_GIB: 500
 });
+/**
+ * Serverless-v2 defaults for the internal dev substrate's shared Aurora cluster
+ * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
+ * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
+ * is the only mode under which min-0 actually saves (a live pooled connection
+ * pins the cluster above 0 ACU). Engine 16.6 satisfies the auto-pause-capable
+ * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`).
+ */
+export const DEV_AURORA_DEFAULTS = Object.freeze({
+    SERVERLESS_V2_MIN_CAPACITY: 0,
+    SERVERLESS_V2_MAX_CAPACITY: 4,
+    AUTO_PAUSE_SECONDS: 1200,
+    ENABLE_DATA_API: true,
+    ENGINE_VERSION: "16.6"
+});
+/**
+ * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`
+ * (5 minutes – 24 hours). A value outside this range synths but is rejected at
+ * deploy, so the resources layer validates it at synth instead.
+ */
+export const SERVERLESS_V2_AUTO_PAUSE_MIN_SECONDS = 300;
+export const SERVERLESS_V2_AUTO_PAUSE_MAX_SECONDS = 86400;
+/**
+ * Minimum Aurora PostgreSQL version that supports serverless-v2 auto-pause
+ * (`serverlessV2MinCapacity` 0). An explicit override below this synths clean
+ * but AccessDenies / rejects at deploy, so the resources layer hard-guards it.
+ */
+export const MIN_AUTO_PAUSE_POSTGRES_VERSION = "16.3";

package/dist/lib/utils/devSubstrateTags.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Tags applied by the internal `DevSubstrate` construct.
+ *
+ * `fjall:dev = "true"` is IAM-load-bearing, not cosmetic. The shipped dev-tier
+ * deploy fence in `@fjall/generator` (`src/schemas/devRolePolicies.ts`) gates its
+ * slot-ops grants on `aws:ResourceTag/fjall:dev = "true"` and
+ * `aws:RequestTag/fjall:dev = "true"`. The key and value here MUST stay
+ * byte-identical to those IAM condition keys — any drift silently unfences the
+ * substrate (the runtime-name-must-match-construct coupling class).
+ *
+ * A util-level single source shared with the policy is a candidate follow-up; it
+ * is deliberately NOT folded here, to avoid editing the parity-locked security
+ * policy from a construct-scaffold change.
+ */
+export declare const DEV_TAG_KEY: "fjall:dev";
+export declare const DEV_TAG_VALUE: "true";
+/**
+ * Reaper / organisational-mapping tag carrying the real customer application id
+ * (distinct from the `fjall-dev-<app>` CDK App identity that drives the
+ * substrate's stack names). NOT part of the IAM fence contract.
+ */
+export declare const DEV_APP_TAG_KEY: "fjall:app";

package/dist/lib/utils/devSubstrateTags.js

@@ -0,0 +1,22 @@
+/**
+ * Tags applied by the internal `DevSubstrate` construct.
+ *
+ * `fjall:dev = "true"` is IAM-load-bearing, not cosmetic. The shipped dev-tier
+ * deploy fence in `@fjall/generator` (`src/schemas/devRolePolicies.ts`) gates its
+ * slot-ops grants on `aws:ResourceTag/fjall:dev = "true"` and
+ * `aws:RequestTag/fjall:dev = "true"`. The key and value here MUST stay
+ * byte-identical to those IAM condition keys — any drift silently unfences the
+ * substrate (the runtime-name-must-match-construct coupling class).
+ *
+ * A util-level single source shared with the policy is a candidate follow-up; it
+ * is deliberately NOT folded here, to avoid editing the parity-locked security
+ * policy from a construct-scaffold change.
+ */
+export const DEV_TAG_KEY = "fjall:dev";
+export const DEV_TAG_VALUE = "true";
+/**
+ * Reaper / organisational-mapping tag carrying the real customer application id
+ * (distinct from the `fjall-dev-<app>` CDK App identity that drives the
+ * substrate's stack names). NOT part of the IAM fence contract.
+ */
+export const DEV_APP_TAG_KEY = "fjall:app";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "2.31.1",
+  "version": "2.32.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
     "clean": "rm -rf ./dist",
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
-    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs",
+    "build": "npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs",
     "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "watch": "tsc -w",
     "watch:only": "tsc -w",
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^2.31.1",
-    "@fjall/util": "^2.31.1",
+    "@fjall/generator": "^2.32.0",
+    "@fjall/util": "^2.32.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "a48cfaf6e050ce1736837802dfcaf517ba39f199"
+  "gitHead": "876a79a9ad0031a5919019c86867c28c1ab9dc92"
 }