@fjall/components-infrastructure 21.1.0 → 23.0.0

package/dist/lib/config/aws/ipam.js

@@ -2,6 +2,7 @@ import { CfnOutput } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { Ipam as IpamClass } from "../../resources/aws/networking/ipam.js";
 import { getConfig } from "../../utils/getConfig.js";
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../utils/costAllocationTags.js";
 import { IPAM_PRIVATE_DEFAULT_SCOPE_EXPORT_NAME } from "../../utils/exportNaming.js";
 export class Ipam extends Construct {
     privateDefaultScopeId;
@@ -18,8 +19,11 @@ export class Ipam extends Construct {
             })),
             tags: [
                 {
-                    key: "fjall:costAllocation:environment",
-                    value: "management"
+                    // Explicit claim, not a fallback: the IPAM is an org-wide pool that
+                    // genuinely lives in the management estate regardless of which app
+                    // synthesises it.
+                    key: COST_ALLOCATION_TAGS.ENVIRONMENT,
+                    value: DEFAULT_COST_ALLOCATION_ENVIRONMENT
                 }
             ]
         });

package/dist/lib/patterns/aws/account.js

@@ -1,4 +1,4 @@
-import { CfnOutput, Stack, Tags } from "aws-cdk-lib";
+import { CfnOutput, Lazy, Stack, Tags } from "aws-cdk-lib";
 import { EcrDefaultImage, SharedAlarmTopic } from "../../config/aws/index.js";
 import { ManagementEventsTrail } from "../../config/aws/cloudTrail.js";
 import { OidcConnector } from "../../config/aws/oidcConnector.js";
@@ -16,6 +16,18 @@ import { SecurityHubHub } from "../../config/aws/securityHubHub.js";
 import { ConfigRecorder } from "../../config/aws/configRecorder.js";
 import { AccountAccessAnalyser } from "../../config/aws/accessAnalyser.js";
 import { InspectorEnablement } from "../../config/aws/inspectorEnablement.js";
+/**
+ * `fjall:description` values for the governance tiers — the same user-facing
+ * gold-plating the domain-side constructs carry, so a governance stack's
+ * resources explain themselves in the console exactly like a zone or
+ * certificate does. Keyed by `organisationType` so each tier self-describes
+ * from ONE stamp in this base class.
+ */
+const GOVERNANCE_TIER_DESCRIPTIONS = {
+    organisation: "Fjall-managed organisation governance: org root, member accounts and organisation-wide policy",
+    platform: "Fjall-managed platform governance: shared platform services and CI trust",
+    account: "Fjall-managed account governance: account security and operations baseline"
+};
 export class Account extends Stack {
     organisationType = "account";
     resolvedRegion;
@@ -33,6 +45,21 @@ export class Account extends Stack {
         // read "FjallApp"; the stack-scope tag wins over App scope and names the
         // governance tier instead ("Organisation"/"Account"/"Platform").
         Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, id);
+        // Lazy, NOT a direct read: subclass field initialisers run after super(),
+        // so `this.organisationType` here would say "account" for every tier (the
+        // same trap the connector-mode note below documents). By synth the field
+        // is final and the tag renders the true tier.
+        //
+        // excludeResourceTypes is load-bearing: stack-level tags travel on the
+        // CloudFormation API call as literal strings, so a Lazy token there
+        // aborts every governance deploy at changeset creation ("Tag
+        // [fjall:description] contained invalid characters"). Resources render
+        // the resolved value in-template; only the stack's own tag set is
+        // skipped — CloudFormation would re-propagate a stack tag to those same
+        // resources anyway.
+        Tags.of(this).add("fjall:description", Lazy.string({
+            produce: () => GOVERNANCE_TIER_DESCRIPTIONS[this.organisationType]
+        }), { excludeResourceTypes: ["aws:cdk:stack"] });
         this.resolvedRegion = region ?? this.region;
         const orgId = this.node.tryGetContext(CDK_CONTEXT_KEYS.ORG_ID);
         if (orgId) {

package/dist/lib/patterns/aws/cdn.d.ts

@@ -98,7 +98,8 @@ export interface S3CdnProps extends BaseCdnProps {
     originAccess?: "oai" | "oac";
     /** Object served for `/` (static sites: "index.html"). */
     defaultRootObject?: string;
-    /** "multipage" → clean-URL `.html` rewriting; "spa" → 403/404 fallback to index. */
+    /** "multipage" (/about → /about.html), "directory" (/about →
+     * /about/index.html) or "spa" (403/404 fall back to /index.html). */
     routing?: StaticSiteRouting;
     /** Security-headers policy (built by the caller, e.g. SecurityHeadersPolicy). */
     responseHeadersPolicy?: IResponseHeadersPolicy;
@@ -193,9 +194,6 @@ export interface SmartCdnBehaviour {
      */
     originRecord?: "alias" | "none";
 }
-/**
- * CDN wrapper class that extends CloudFrontDistribution with Fjall patterns.
- */
 export declare class Cdn extends CloudFrontDistribution implements ICdn {
     constructor(scope: Construct, id: string, props: ICdnProps);
     private static createEcsOriginResolver;

package/dist/lib/patterns/aws/cdn.js

@@ -208,6 +208,19 @@ function validateCdnProps(props) {
 /**
  * CDN wrapper class that extends CloudFrontDistribution with Fjall patterns.
  */
+/**
+ * What each routing mode asks of the distribution, total over the routing
+ * vocabulary — a mode added to `STATIC_SITE_ROUTING_VALUES` fails to compile
+ * here until it declares its CDN behaviour, instead of silently synthesising
+ * a distribution that ignores it. `multipage` and `directory` rewrite URIs in
+ * a viewer-request function; `spa` skips rewriting and relies on 403/404
+ * error responses falling back to `/index.html`.
+ */
+const ROUTING_CDN_BEHAVIOUR = {
+    multipage: { uriRewrite: "html" },
+    directory: { uriRewrite: "directory-index" },
+    spa: { spaFallback: true }
+};
 export class Cdn extends CloudFrontDistribution {
     constructor(scope, id, props) {
         validateCdnProps(props);
@@ -429,8 +442,8 @@ export class Cdn extends CloudFrontDistribution {
         const s3Routing = props.originType === "s3"
             ? {
                 defaultRootObject: props.defaultRootObject,
-                cleanUrls: props.routing === "multipage",
-                spaFallback: props.routing === "spa",
+                ...(props.routing !== undefined &&
+                    ROUTING_CDN_BEHAVIOUR[props.routing]),
                 responseHeadersPolicy: props.responseHeadersPolicy,
                 originRequestPolicy: props.originRequestPolicy
             }

package/dist/lib/patterns/aws/interfaces/pattern.d.ts

@@ -452,7 +452,10 @@ export interface IStaticSiteProps {
     source: string;
     /** Build command + output directory (single source of truth). */
     build: StaticSiteBuildConfig;
-    /** "multipage" (clean-URL `.html` rewriting) or "spa". Default: "multipage". */
+    /** "multipage" (/about → /about.html), "directory" (/about →
+     * /about/index.html — Astro's default layout) or "spa" (unknown paths fall
+     * back to /index.html). Match it to the build's emitted layout.
+     * Default: "multipage". */
     routing?: StaticSiteRouting;
     /** Security-header configuration. */
     security?: StaticSiteSecurityConfig;

package/dist/lib/patterns/aws/staticSite.d.ts

@@ -7,7 +7,7 @@
  *
  * Resources created:
  * - Private S3 bucket + BucketDeployment (asset upload)
- * - CloudFront distribution (OAC, clean-URL function, security-headers policy)
+ * - CloudFront distribution (OAC, routing-mode viewer function, security-headers policy)
  * - ACM certificate + Route53 alias record (when `domain` is set)
  * - Contact-form Lambda + Function URL (when `forms` is set)
  *

package/dist/lib/patterns/aws/staticSite.js

@@ -7,7 +7,7 @@
  *
  * Resources created:
  * - Private S3 bucket + BucketDeployment (asset upload)
- * - CloudFront distribution (OAC, clean-URL function, security-headers policy)
+ * - CloudFront distribution (OAC, routing-mode viewer function, security-headers policy)
  * - ACM certificate + Route53 alias record (when `domain` is set)
  * - Contact-form Lambda + Function URL (when `forms` is set)
  *
@@ -182,6 +182,11 @@ export class StaticSite extends Construct {
             bucket: this._bucket,
             originAccess: "oac",
             defaultRootObject: "index.html",
+            // The default VALUE stays "multipage" for configs that omit `routing`,
+            // but multipage's own semantics changed with the mode split: the old
+            // hybrid fragment served trailing-slash links from `…/index.html`. A
+            // deployed directory-layout site that relied on that must now state
+            // routing: "directory" — the default cannot protect it.
             routing: this.props.routing ?? "multipage",
             cachePolicy: "CACHING_OPTIMIZED",
             priceClass: "PriceClass_100",

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -38,6 +38,8 @@ export interface AccessGateConfig {
     username: string;
     password: string;
 }
+/** See {@link CloudFrontDistributionProps.uriRewrite}. */
+export type UriRewriteMode = "html" | "directory-index";
 export interface CloudFrontDistributionProps {
     /**
      * App this CDN fronts. Keys the cross-stack export a `Domain` resolves via
@@ -67,9 +69,22 @@ export interface CloudFrontDistributionProps {
     accessGate?: false | AccessGateConfig;
     /** Object served for a bare `/` request (static sites: "index.html"). */
     defaultRootObject?: string;
-    /** Rewrites extensionless URLs to `.html`/`/index.html` via a CloudFront
-     * Function. Dynamic `/api/` paths are carved out so POSTs are not rewritten. */
-    cleanUrls?: boolean;
+    /**
+     * Rewrites pretty URLs onto the objects the build actually emitted, via a
+     * CloudFront Function. Each mode serves BOTH link shapes (`/about` and
+     * `/about/`) from its layout's object:
+     *
+     * - `"html"` → `/about.html`: builds that emit sibling `.html` files
+     *   (Astro `build.format: "file"`, Next.js default export).
+     * - `"directory-index"` → `/about/index.html`: builds that emit a
+     *   directory per page (Astro's default `build.format: "directory"`).
+     *
+     * Dynamic `/api/` paths are carved out so POSTs are not rewritten.
+     * Replaces the former `cleanUrls: boolean`, whose single fragment rewrote
+     * trailing-slash requests to `…/index.html` and bare requests to `….html`
+     * — a hybrid that served neither layout completely.
+     */
+    uriRewrite?: UriRewriteMode;
     /** SPA fallback: 403/404 → `/index.html` @200 for client-side routing. */
     spaFallback?: boolean;
     /** Security-headers policy applied to the default + every additional behaviour. */
@@ -98,14 +113,14 @@ export declare class CloudFrontDistribution extends Construct {
     constructor(scope: Construct, id: string, props: CloudFrontDistributionProps);
     /**
      * Build a composable CloudFront Function for VIEWER_REQUEST.
-     * Merges accessGate, forwardHostHeader and cleanUrls into a single function
-     * (CloudFront allows only one function per event type).
+     * Merges accessGate, forwardHostHeader and uriRewrite into a single
+     * function (CloudFront allows only one function per event type).
      *
      * ORDER IS LOAD-BEARING. The access gate is emitted first because it is the
      * only fragment that can reject a request, and a fragment that returns early
      * ahead of it would silently un-gate whatever paths it short-circuits. The
-     * cleanUrls fragment carves `/api/*` out of the `.html` rewriting — that
-     * carve-out must therefore be a guard around the rewrite, never an early
+     * uriRewrite fragments carve `/api/*` out of the rewriting — that carve-out
+     * must therefore be a guard around the rewrite, never an early
      * `return request`, or the whole `/api/*` surface leaves the gate behind it.
      */
     private buildViewerRequestFunction;

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -4,6 +4,43 @@ import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { cdnDomainExportName } from "@fjall/util";
 import { Distribution, PriceClass, ViewerProtocolPolicy, CachePolicy, OriginRequestPolicy, AllowedMethods, OriginProtocolPolicy, Function as CloudFrontFunction, FunctionCode, FunctionRuntime, FunctionEventType, OriginAccessIdentity, S3OriginAccessControl } from "aws-cdk-lib/aws-cloudfront";
 import { S3BucketOrigin, LoadBalancerV2Origin, HttpOrigin } from "aws-cdk-lib/aws-cloudfront-origins";
+/**
+ * The viewer-request rewrite for each `UriRewriteMode`, keyed on the mode so
+ * a new mode fails to compile until it states its rewrite.
+ *
+ * Both fragments keep the `/api/*` carve-out as a GUARD around the rewrite,
+ * never an early `return request` — see the ordering contract on
+ * `buildViewerRequestFunction`: a fragment that returns early would let every
+ * path it short-circuits leave later fragments behind it.
+ *
+ * `"html"`: `/about` and `/about/` both → `/about.html`. The trailing slash
+ * is stripped before `.html` is appended — the build emitted a FILE, so the
+ * old hybrid's `/about/` → `/about/index.html` named an object that does not
+ * exist in this layout. The root `/` becomes `/index.html` (both layouts
+ * emit one), so neither mode depends on `defaultRootObject` being set.
+ *
+ * `"directory-index"`: `/about` and `/about/` both → `/about/index.html`,
+ * matching the directory-per-page layout (the root `/` likewise becomes
+ * `/index.html`).
+ *
+ * Requests whose last segment carries an extension (`/assets/app.css`) pass
+ * through untouched in both modes, and so does any path containing a
+ * dot-directory (`/.well-known/apple-app-site-association` must be served
+ * byte-for-byte — dot-paths are literal files, never pretty URLs).
+ */
+const URI_REWRITE_FRAGMENTS = {
+    html: " var uri = request.uri;" +
+        " if (!uri.startsWith('/api/') && uri.indexOf('/.') === -1) {" +
+        " if (uri === '/') { request.uri = '/index.html'; }" +
+        " else if (uri.endsWith('/')) { request.uri = uri.substring(0, uri.length - 1) + '.html'; }" +
+        " else { var seg = uri.substring(uri.lastIndexOf('/') + 1);" +
+        " if (seg.indexOf('.') === -1) { request.uri = uri + '.html'; } } }",
+    "directory-index": " var uri = request.uri;" +
+        " if (!uri.startsWith('/api/') && uri.indexOf('/.') === -1) {" +
+        " if (uri.endsWith('/')) { request.uri = uri + 'index.html'; }" +
+        " else { var seg = uri.substring(uri.lastIndexOf('/') + 1);" +
+        " if (seg.indexOf('.') === -1) { request.uri = uri + '/index.html'; } } }"
+};
 export class CloudFrontDistribution extends Construct {
     id;
     distribution;
@@ -20,8 +57,8 @@ export class CloudFrontDistribution extends Construct {
         const defaultOrigin = this.createOrigin(props.defaultOrigin);
         const defaultCachePolicy = this.resolveCachePolicy(props.defaultCachePolicy);
         // Build composable viewer request function (accessGate + forwardHostHeader
-        // + cleanUrls)
-        const viewerRequestFunction = this.buildViewerRequestFunction(id, props.forwardHostHeader, props.accessGate, props.cleanUrls);
+        // + uriRewrite)
+        const viewerRequestFunction = this.buildViewerRequestFunction(id, props.forwardHostHeader, props.accessGate, props.uriRewrite);
         const functionAssociations = viewerRequestFunction
             ? [
                 {
@@ -96,18 +133,18 @@ export class CloudFrontDistribution extends Construct {
     }
     /**
      * Build a composable CloudFront Function for VIEWER_REQUEST.
-     * Merges accessGate, forwardHostHeader and cleanUrls into a single function
-     * (CloudFront allows only one function per event type).
+     * Merges accessGate, forwardHostHeader and uriRewrite into a single
+     * function (CloudFront allows only one function per event type).
      *
      * ORDER IS LOAD-BEARING. The access gate is emitted first because it is the
      * only fragment that can reject a request, and a fragment that returns early
      * ahead of it would silently un-gate whatever paths it short-circuits. The
-     * cleanUrls fragment carves `/api/*` out of the `.html` rewriting — that
-     * carve-out must therefore be a guard around the rewrite, never an early
+     * uriRewrite fragments carve `/api/*` out of the rewriting — that carve-out
+     * must therefore be a guard around the rewrite, never an early
      * `return request`, or the whole `/api/*` surface leaves the gate behind it.
      */
-    buildViewerRequestFunction(id, forwardHostHeader, accessGate, cleanUrls) {
-        if (!accessGate && !forwardHostHeader && !cleanUrls) {
+    buildViewerRequestFunction(id, forwardHostHeader, accessGate, uriRewrite) {
+        if (!accessGate && !forwardHostHeader && uriRewrite === undefined) {
             return undefined;
         }
         const fragments = [];
@@ -125,12 +162,8 @@ export class CloudFrontDistribution extends Construct {
         if (forwardHostHeader) {
             fragments.push(" request.headers['x-forwarded-host'] = { value: request.headers.host.value };");
         }
-        if (cleanUrls) {
-            fragments.push(" var uri = request.uri;" +
-                " if (!uri.startsWith('/api/')) {" +
-                " if (uri.endsWith('/')) { request.uri = uri + 'index.html'; }" +
-                " else { var seg = uri.substring(uri.lastIndexOf('/') + 1);" +
-                " if (seg.indexOf('.') === -1) { request.uri = uri + '.html'; } } }");
+        if (uriRewrite !== undefined) {
+            fragments.push(URI_REWRITE_FRAGMENTS[uriRewrite]);
         }
         const functionBody = "function handler(event) { var request = event.request;" +
             fragments.join("") +

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -303,13 +303,11 @@ export function addHostedZone(ctx, loadBalancer) {
             domainName,
             ...(subjectAlternativeNames.length > 0 && { subjectAlternativeNames }),
             hostedZone,
-            // Honest environment tag: the cluster's app already tags the
+            // No costAllocationEnvironment: the cluster's app already tags the
             // account-stage-resolved environment tree-wide (App.globalTags via
-            // getConfig); the mint must inherit it, not out-tag it with the
-            // resource-level "management" default. No sniffing here — any local
-            // re-resolution (context/env-var channels) can diverge from the app
-            // cascade, and did on the first live plan.
-            inheritCostAllocationEnvironment: true,
+            // getConfig) and the mint inherits it. No local re-resolution
+            // (context/env-var channels) — it can diverge from the app cascade,
+            // and did on the first live plan.
             // The cert is consumed in-stack by the ALB listener; exporting would
             // collide with a managed-domain/apex stack that owns the domain's
             // export names.

package/dist/lib/resources/aws/iam/delegationRole.js

@@ -1,11 +1,11 @@
 import { createHash } from "node:crypto";
 import { Construct } from "constructs";
-import { ArnFormat, CfnOutput, Stack, Tags } from "aws-cdk-lib";
+import { ArnFormat, CfnOutput, Stack } from "aws-cdk-lib";
 import { OrganizationPrincipal, PolicyDocument, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { getDomainExportNames } from "@fjall/util";
 import { Role } from "./role.js";
 import { capitaliseString, toPascalCase, getSafeZoneName } from "../../../utils/capitaliseString.js";
-import { DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 // The suffix is a deployed contract: the SCP dev-isolation carve-out
 // wildcards arn:aws:iam::*:role/*DelegateHostedZoneRole (scpPreset).
 const ROLE_NAME_SUFFIX = "DelegateHostedZoneRole";
@@ -86,9 +86,11 @@ export class DelegationRole extends Construct {
         props.hostedZone.grantDelegation(role);
         this.role = role;
         this.roleArn = role.roleArn;
-        Tags.of(this).add("fjall:costAllocation:environment", props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add("fjall:costAllocation:service", "delegationRole");
-        Tags.of(this).add("fjall:costAllocation:domain", props.costAllocationDomain ?? props.zoneName);
+        applyCostAllocationTags(this, {
+            service: "delegationRole",
+            domain: props.costAllocationDomain ?? props.zoneName,
+            environment: props.costAllocationEnvironment
+        });
         const exportName = getDomainExportNames(props.zoneName).delegationRoleArn;
         this.exportName = exportName;
         new CfnOutput(this, `${safeZone}DelegationRoleArn`, {

package/dist/lib/resources/aws/networking/domainCertificate.d.ts

@@ -7,16 +7,8 @@ export interface DomainCertificateProps {
     readonly hostedZone: IHostedZone;
     readonly description?: string;
     readonly transparencyLogging?: boolean;
+    /** Omit to inherit the App cascade's environment tag (see CostAllocationTagsArgs). */
     readonly costAllocationEnvironment?: string;
-    /**
-     * Inherit the environment tag from an outer cascade (the fjall App's
-     * global tags) instead of stamping the "management" default when
-     * `costAllocationEnvironment` is not given. In-stack certificates minted
-     * inside an application (the ECS fallthrough mint) must set this: the
-     * cluster's app already tags the resolved environment tree-wide, and the
-     * resource-level default would out-tag it (deeper scope wins).
-     */
-    readonly inheritCostAllocationEnvironment?: boolean;
     readonly costAllocationDomain?: string;
     /**
      * Publish the `${domain}-certificate-arn` CloudFormation export. Default true.

package/dist/lib/resources/aws/networking/domainCertificate.js

@@ -40,8 +40,7 @@ export class DomainCertificate extends Certificate {
         applyCostAllocationTags(this, {
             service: "certificate",
             domain: sanitiseAcmTagValue(props.costAllocationDomain ?? props.domainName),
-            environment: props.costAllocationEnvironment,
-            inheritEnvironment: props.inheritCostAllocationEnvironment
+            environment: props.costAllocationEnvironment
         });
         if (props.exportCertificateArn !== false) {
             const safeKey = toPascalCase(props.domainName.split(".").join(""));

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.d.ts

@@ -6,7 +6,7 @@ export interface VpcPeeringAccepterRoleProps {
     readonly requesterAccountIds: string[];
     /** The local VPC this role is scoped to. */
     readonly localVpc: IVpc;
-    /** Cost-allocation override — defaults to `"management"`. */
+    /** Omit to inherit the App cascade's environment tag (see CostAllocationTagsArgs). */
     readonly costAllocationEnvironment?: string;
     /** Cost-allocation override — defaults to the local VPC's construct id. */
     readonly costAllocationDomain?: string;

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.js

@@ -1,7 +1,7 @@
 import { Construct } from "constructs";
 import { ArnFormat, Stack, Tags } from "aws-cdk-lib";
 import { AccountPrincipal, CompositePrincipal, PolicyDocument, PolicyStatement, Role } from "aws-cdk-lib/aws-iam";
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 export class VpcPeeringAccepterRole extends Construct {
     role;
     roleArn;
@@ -54,8 +54,10 @@ export class VpcPeeringAccepterRole extends Construct {
         });
         this.roleArn = this.role.roleArn;
         Tags.of(this).add("fjall:resource:type", "vpc-peering-accepter");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.ENVIRONMENT, props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, "vpcPeeringAccepter");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.DOMAIN, props.costAllocationDomain ?? props.localVpc.node.id);
+        applyCostAllocationTags(this, {
+            service: "vpcPeeringAccepter",
+            domain: props.costAllocationDomain ?? props.localVpc.node.id,
+            environment: props.costAllocationEnvironment
+        });
     }
 }

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -3,7 +3,7 @@ import { Stack, Tags } from "aws-cdk-lib";
 import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
-import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "../../../utils/costAllocationTags.js";
+import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
@@ -100,8 +100,10 @@ export class VpcPeeringConnection extends Construct {
         if (props.peerAppName) {
             Tags.of(this).add("fjall:peering:peer-app", props.peerAppName);
         }
-        Tags.of(this).add(COST_ALLOCATION_TAGS.ENVIRONMENT, props.costAllocationEnvironment ?? DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-        Tags.of(this).add(COST_ALLOCATION_TAGS.SERVICE, "vpcPeering");
-        Tags.of(this).add(COST_ALLOCATION_TAGS.DOMAIN, props.costAllocationDomain ?? props.peerAppName ?? props.peerVpcId);
+        applyCostAllocationTags(this, {
+            service: "vpcPeering",
+            domain: props.costAllocationDomain ?? props.peerAppName ?? props.peerVpcId,
+            environment: props.costAllocationEnvironment
+        });
     }
 }

package/dist/lib/utils/costAllocationTags.d.ts

@@ -4,16 +4,17 @@ export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
 export interface CostAllocationTagsArgs {
     readonly service: string;
     readonly domain: string;
-    readonly environment?: string;
     /**
-     * When `environment` is not given, skip the environment tag at this scope
-     * entirely instead of stamping the "management" default, so an outer
-     * cascade (the fjall App's global tags carry the account-stage-resolved
-     * environment) provides it. Without this, the deeper-scope default wins
-     * CDK tag resolution and a production stack's resource is mis-tagged
-     * "management". An explicit `environment` always wins over inheritance.
+     * Omit to INHERIT: the fjall App root always stamps the account-stage-
+     * resolved environment tree-wide ("unknown" when unresolvable — getConfig
+     * never leaves it blank), and CDK resolves tag conflicts deeper-scope-wins,
+     * so a construct-level fallback here would out-tag the truth. That is how
+     * live zones were mis-tagged "management" inside staged apps. A construct
+     * stamps an environment ONLY when its caller makes an explicit claim —
+     * including an explicit `DEFAULT_COST_ALLOCATION_ENVIRONMENT` for genuinely
+     * stage-less, management-estate resources.
      */
-    readonly inheritEnvironment?: boolean;
+    readonly environment?: string;
     readonly owner?: string;
 }
 export declare function applyCostAllocationTags(scope: IConstruct, args: CostAllocationTagsArgs): void;

package/dist/lib/utils/costAllocationTags.js

@@ -8,9 +8,6 @@ export function applyCostAllocationTags(scope, args) {
     if (args.environment !== undefined) {
         Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, args.environment);
     }
-    else if (args.inheritEnvironment !== true) {
-        Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, DEFAULT_COST_ALLOCATION_ENVIRONMENT);
-    }
     Tags.of(scope).add(COST_ALLOCATION_TAGS.SERVICE, args.service);
     Tags.of(scope).add(COST_ALLOCATION_TAGS.DOMAIN, args.domain);
     if (args.owner !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "21.1.0",
+  "version": "23.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^21.1.0",
-    "@fjall/util": "^21.1.0",
+    "@fjall/generator": "^23.0.0",
+    "@fjall/util": "^23.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {