@fjall/components-infrastructure 21.0.0 → 22.0.0

package/dist/lib/config/aws/ipam.js

@@ -2,6 +2,7 @@ import { CfnOutput } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { Ipam as IpamClass } from "../../resources/aws/networking/ipam.js";
 import { getConfig } from "../../utils/getConfig.js";
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../utils/costAllocationTags.js";
 import { IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME } from "../../utils/exportNaming.js";
 export class Ipam extends Construct {
     privateDefaultScopeId;
@@ -18,8 +19,11 @@ export class Ipam extends Construct {
             })),
             tags: [
                 {
-                    key: "fjall:costAllocation:environment",
-                    value: "management"
+                    // Explicit claim, not a fallback: the IPAM is an org-wide pool that
+                    // genuinely lives in the management estate regardless of which app
+                    // synthesises it.
+                    key: COST_ALLOCATION_TAGS.ENVIRONMENT,
+                    value: DEFAULT_COST_ALLOCATION_ENVIRONMENT
                 }
             ]
         });

package/dist/lib/patterns/aws/account.js

@@ -1,4 +1,4 @@
-import { CfnOutput, Stack, Tags } from "aws-cdk-lib";
+import { CfnOutput, Lazy, Stack, Tags } from "aws-cdk-lib";
 import { EcrDefaultImage, SharedAlarmTopic } from "../../config/aws/index.js";
 import { ManagementEventsTrail } from "../../config/aws/cloudTrail.js";
 import { OidcConnector } from "../../config/aws/oidcConnector.js";
@@ -16,6 +16,18 @@ import { SecurityHubHub } from "../../config/aws/securityHubHub.js";
 import { ConfigRecorder } from "../../config/aws/configRecorder.js";
 import { AccountAccessAnalyser } from "../../config/aws/accessAnalyser.js";
 import { InspectorEnablement } from "../../config/aws/inspectorEnablement.js";
+/**
+ * `fjall:description` values for the governance tiers — the same user-facing
+ * gold-plating the domain-side constructs carry, so a governance stack's
+ * resources explain themselves in the console exactly like a zone or
+ * certificate does. Keyed by `organisationType` so each tier self-describes
+ * from ONE stamp in this base class.
+ */
+const GOVERNANCE_TIER_DESCRIPTIONS = {
+    organisation: "Fjall-managed organisation governance: org root, member accounts and organisation-wide policy",
+    platform: "Fjall-managed platform governance: shared platform services and CI trust",
+    account: "Fjall-managed account governance: account security and operations baseline"
+};
 export class Account extends Stack {
     organisationType = "account";
     resolvedRegion;
@@ -33,6 +45,13 @@ export class Account extends Stack {
         // read "FjallApp"; the stack-scope tag wins over App scope and names the
         // governance tier instead ("Organisation"/"Account"/"Platform").
         Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, id);
+        // Lazy, NOT a direct read: subclass field initialisers run after super(),
+        // so `this.organisationType` here would say "account" for every tier (the
+        // same trap the connector-mode note below documents). By synth the field
+        // is final and the tag renders the true tier.
+        Tags.of(this).add("fjall:description", Lazy.string({
+            produce: () => GOVERNANCE_TIER_DESCRIPTIONS[this.organisationType]
+        }));
         this.resolvedRegion = region ?? this.region;
         const orgId = this.node.tryGetContext(CDK_CONTEXT_KEYS.ORG_ID);
         if (orgId) {

package/dist/lib/patterns/aws/database.js

@@ -24,8 +24,8 @@ export const DATABASE_ENGINE_CONFIG = Object.freeze({
         sslParameters: { "rds.force_ssl": "1" }
     },
     mysql: {
-        // majorVersion must be Aurora version (3.12.0), NOT MySQL version (8.0)
-        aurora: { version: "8.0.mysql_aurora.3.12.0", majorVersion: "3.12.0" },
+        // majorVersion must be Aurora version (3.13.0), NOT MySQL version (8.0)
+        aurora: { version: "8.0.mysql_aurora.3.13.0", majorVersion: "3.13.0" },
         instance: { version: "8.4.9", majorVersion: "8.4" },
         defaultUsername: "admin",
         sslParameters: { require_secure_transport: "ON" }

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -303,13 +303,11 @@ export function addHostedZone(ctx, loadBalancer) {
             domainName,
             ...(subjectAlternativeNames.length > 0 && { subjectAlternativeNames }),
             hostedZone,
-            // Honest environment tag: the cluster's app already tags the
+            // No costAllocationEnvironment: the cluster's app already tags the
             // account-stage-resolved environment tree-wide (App.globalTags via
-            // getConfig); the mint must inherit it, not out-tag it with the
-            // resource-level "management" default. No sniffing here — any local
-            // re-resolution (context/env-var channels) can diverge from the app
-            // cascade, and did on the first live plan.
-            inheritCostAllocationEnvironment: true,
+            // getConfig) and the mint inherits it. No local re-resolution
+            // (context/env-var channels) — it can diverge from the app cascade,
+            // and did on the first live plan.
             // The cert is consumed in-stack by the ALB listener; exporting would
             // collide with a managed-domain/apex stack that owns the domain's
             // export names.

package/dist/lib/resources/aws/iam/delegationRole.js

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
 import { Construct } from "constructs";
-import { ArnFormat, CfnOutput, Stack, Tags } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Stack } from "aws-cdk-lib";
 import { OrganizationPrincipal, PolicyDocument, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { getDomainExportNames } from "@fjall/util";
 import { Role } from "./role.js";
 import { capitaliseString, toPascalCase, getSafeZoneName } from "../../../utils/capitaliseString.js";
-import { DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 // The suffix is a deployed contract: the SCP dev-isolation carve-out
 // wildcards arn:aws:iam::*:role/*DelegateHostedZoneRole (scpPreset).
 const ROLE_NAME_SUFFIX = "DelegateHostedZoneRole";
@@ -86,9 +86,11 @@ export class DelegationRole extends Construct {
         props.hostedZone.grantDelegation(role);
         this.role = role;
         this.roleArn = role.roleArn;
-        Tags.of(this).add("fjall:costAllocation:environment", props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add("fjall:costAllocation:service", "delegationRole");
-        Tags.of(this).add("fjall:costAllocation:domain", props.costAllocationDomain ?? props.zoneName);
+        applyCostAllocationTags(this, {
+            service: "delegationRole",
+            domain: props.costAllocationDomain ?? props.zoneName,
+            environment: props.costAllocationEnvironment
+        });
         const exportName = getDomainExportNames(props.zoneName).delegationRoleArn;
         this.exportName = exportName;
         new CfnOutput(this, `${safeZone}DelegationRoleArn`, {

package/dist/lib/resources/aws/networking/domainCertificate.d.ts

@@ -7,16 +7,8 @@ export interface DomainCertificateProps {
     readonly hostedZone: IHostedZone;
     readonly description?: string;
     readonly transparencyLogging?: boolean;
+    /** Omit to inherit the App cascade's environment tag (see CostAllocationTagsArgs). */
     readonly costAllocationEnvironment?: string;
-    /**
-     * Inherit the environment tag from an outer cascade (the fjall App's
-     * global tags) instead of stamping the "management" default when
-     * `costAllocationEnvironment` is not given. In-stack certificates minted
-     * inside an application (the ECS fallthrough mint) must set this: the
-     * cluster's app already tags the resolved environment tree-wide, and the
-     * resource-level default would out-tag it (deeper scope wins).
-     */
-    readonly inheritCostAllocationEnvironment?: boolean;
     readonly costAllocationDomain?: string;
     /**
      * Publish the `${domain}-certificate-arn` CloudFormation export. Default true.

package/dist/lib/resources/aws/networking/domainCertificate.js

@@ -40,8 +40,7 @@ export class DomainCertificate extends Certificate {
         applyCostAllocationTags(this, {
             service: "certificate",
             domain: sanitiseAcmTagValue(props.costAllocationDomain ?? props.domainName),
-            environment: props.costAllocationEnvironment,
-            inheritEnvironment: props.inheritCostAllocationEnvironment
+            environment: props.costAllocationEnvironment
         });
         if (props.exportCertificateArn !== false) {
             const safeKey = toPascalCase(props.domainName.split(".").join(""));

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.d.ts

@@ -6,7 +6,7 @@ export interface VpcPeeringAccepterRoleProps {
     readonly requesterAccountIds: string[];
     /** The local VPC this role is scoped to. */
     readonly localVpc: IVpc;
-    /** Cost-allocation override — defaults to `"management"`. */
+    /** Omit to inherit the App cascade's environment tag (see CostAllocationTagsArgs). */
     readonly costAllocationEnvironment?: string;
     /** Cost-allocation override — defaults to the local VPC's construct id. */
     readonly costAllocationDomain?: string;

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.js

@@ -1,7 +1,7 @@
 import { Construct } from "constructs";
 import { ArnFormat, Stack, Tags } from "aws-cdk-lib";
 import { AccountPrincipal, CompositePrincipal, PolicyDocument, PolicyStatement, Role } from "aws-cdk-lib/aws-iam";
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 export class VpcPeeringAccepterRole extends Construct {
     role;
     roleArn;
@@ -54,8 +54,10 @@ export class VpcPeeringAccepterRole extends Construct {
         });
         this.roleArn = this.role.roleArn;
         Tags.of(this).add("fjall:resource:type", "vpc-peering-accepter");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.ENVIRONMENT, props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, "vpcPeeringAccepter");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.DOMAIN, props.costAllocationDomain ?? props.localVpc.node.id);
+        applyCostAllocationTags(this, {
+            service: "vpcPeeringAccepter",
+            domain: props.costAllocationDomain ?? props.localVpc.node.id,
+            environment: props.costAllocationEnvironment
+        });
     }
 }

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -3,7 +3,7 @@ import { Stack, Tags } from "aws-cdk-lib";
 import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
@@ -100,8 +100,10 @@ export class VpcPeeringConnection extends Construct {
         if (props.peerAppName) {
             Tags.of(this).add("fjall:peering:peer-app", props.peerAppName);
         }
-        Tags.of(this).add(COST_ALLOCATION_TAGS.ENVIRONMENT, props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, "vpcPeering");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.DOMAIN, props.costAllocationDomain ?? props.peerAppName ?? props.peerVpcId);
+        applyCostAllocationTags(this, {
+            service: "vpcPeering",
+            domain: props.costAllocationDomain ?? props.peerAppName ?? props.peerVpcId,
+            environment: props.costAllocationEnvironment
+        });
     }
 }

package/dist/lib/utils/costAllocationTags.d.ts

@@ -4,16 +4,17 @@ export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
 export interface CostAllocationTagsArgs {
     readonly service: string;
     readonly domain: string;
-    readonly environment?: string;
     /**
-     * When `environment` is not given, skip the environment tag at this scope
-     * entirely instead of stamping the "management" default, so an outer
-     * cascade (the fjall App's global tags carry the account-stage-resolved
-     * environment) provides it. Without this, the deeper-scope default wins
-     * CDK tag resolution and a production stack's resource is mis-tagged
-     * "management". An explicit `environment` always wins over inheritance.
+     * Omit to INHERIT: the fjall App root always stamps the account-stage-
+     * resolved environment tree-wide ("unknown" when unresolvable — getConfig
+     * never leaves it blank), and CDK resolves tag conflicts deeper-scope-wins,
+     * so a construct-level fallback here would out-tag the truth. That is how
+     * live zones were mis-tagged "management" inside staged apps. A construct
+     * stamps an environment ONLY when its caller makes an explicit claim —
+     * including an explicit `DEFAULT_COST_ALLOCATION_ENVIRONMENT` for genuinely
+     * stage-less, management-estate resources.
      */
-    readonly inheritEnvironment?: boolean;
+    readonly environment?: string;
     readonly owner?: string;
 }
 export declare function applyCostAllocationTags(scope: IConstruct, args: CostAllocationTagsArgs): void;

package/dist/lib/utils/costAllocationTags.js

@@ -8,9 +8,6 @@ export function applyCostAllocationTags(scope, args) {
     if (args.environment !== undefined) {
         Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, args.environment);
     }
-    else if (args.inheritEnvironment !== true) {
-        Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-    }
     Tags.of(scope).add(COST_ALLOCATION_TAGS.SERVICE, args.service);
     Tags.of(scope).add(COST_ALLOCATION_TAGS.DOMAIN, args.domain);
     if (args.owner !== undefined) {

package/dist/lib/utils/validationLogger.js

@@ -4,20 +4,29 @@
  * Also writes to JSONL file for debugging and support.
  */
 import { appendFileSync, existsSync, mkdirSync } from "fs";
-import { homedir } from "os";
 import { join } from "path";
-const ENV_LOG_DIR = process.env.FJALL_LOG_DIR;
-const LOG_DIR = ENV_LOG_DIR !== undefined && ENV_LOG_DIR !== ""
-    ? ENV_LOG_DIR
-    : join(homedir(), ".fjall", "logs");
-const LOG_FILE = join(LOG_DIR, "infrastructure.jsonl");
+import { fjallLogDir } from "@fjall/util";
+import { FileRotator, LOG_ROTATION_DEFAULTS } from "@fjall/util/logRotation";
+const LOG_FILENAME = "infrastructure.jsonl";
+/**
+ * Shared with the CLI's own logs, so this file cannot outgrow the budget
+ * the rest of Fjall's logging keeps to. Without it this log had no bound of
+ * any kind: it is appended to on every CDK synth, and one developer machine
+ * reached 267MB of it inside a single release cycle.
+ */
+const rotator = new FileRotator({
+    maxFiles: LOG_ROTATION_DEFAULTS.MAX_FILES
+});
 /**
  * Write a log entry to the infrastructure JSONL file
  */
 function writeToLog(level, message) {
     try {
-        if (!existsSync(LOG_DIR)) {
-            mkdirSync(LOG_DIR, { recursive: true });
+        // Resolved per write, not at module load: the log dir is an env var and
+        // CDK imports this module long before a command has read its environment.
+        const logDir = fjallLogDir();
+        if (!existsSync(logDir)) {
+            mkdirSync(logDir, { recursive: true });
         }
         const entry = JSON.stringify({
             timestamp: new Date().toISOString(),
@@ -26,7 +35,9 @@ function writeToLog(level, message) {
             message,
             source: "cdk-subprocess"
         });
-        appendFileSync(LOG_FILE, entry + "\n");
+        const logPath = join(logDir, LOG_FILENAME);
+        rotator.rotateIfNeeded(logPath, LOG_ROTATION_DEFAULTS.MAX_FILE_SIZE);
+        appendFileSync(logPath, entry + "\n");
     }
     catch (err) {
         console.debug("[Fjall] writeToLog failed:", err instanceof Error ? err.message : String(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "21.0.0",
+  "version": "22.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^21.0.0",
-    "@fjall/util": "^21.0.0",
+    "@fjall/generator": "^22.0.0",
+    "@fjall/util": "^22.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {