@fjall/components-infrastructure 28.4.0 → 30.0.0

package/dist/lib/app.d.ts

@@ -55,7 +55,10 @@ export interface IAppOptions {
     /**
      * Backup configuration for automatic AWS Backup enrolment.
      * - Object with tier: Tags all resources with `fjall:disasterRecovery:tier`
-     * - false: Explicitly disabled (no backup tag)
+     *   and sets the app backup tier that resource defaults derive from — S3
+     *   buckets version by default at `resilient`/`enterprise`; a per-bucket
+     *   `backupVaultTier` overrides the tier for that bucket.
+     * - false: Explicitly disabled (no backup tag, no tier-derived defaults)
      */
     backup?: {
         tier: BackupTier;
@@ -107,14 +110,24 @@ export declare class App extends CdkApp {
     private bastion?;
     private networkDisabled;
     private globalTags;
+    private backupTier?;
+    private backupTierObserved;
     private aspectApplied;
     private resourceInventory?;
     private manifestCollector;
     private constructor();
-    private applyBackupTag;
+    private applyBackupTier;
     private initialiseTunnel;
     private initialiseNetwork;
     getName(): string;
+    /**
+     * The app-level backup tier from `backup: { tier }`, or undefined when no
+     * backup is declared. Factories thread it to resources whose defaults derive
+     * from it (S3 versioning); a per-resource `backupVaultTier` overrides it.
+     * Reading it pins the tier: a `backup` applied on a later `getApp` call
+     * throws, so no resource can carry the tier's tag without its defaults.
+     */
+    getBackupTier(): BackupTier | undefined;
     static getApp(name?: string, options?: IAppOptions): App;
     static getInstance(name?: string, options?: IAppOptions): App;
     /**
@@ -345,10 +358,10 @@ export declare class App extends CdkApp {
      * Add a storage resource (S3) to the default storage stack using the factory pattern.
      *
      * @example
-     * // Private bucket (default)
-     * const assets = app.addStorage(StorageFactory.build("Assets", {
-     *   versioned: true
-     * }));
+     * // Private bucket (default). Versioning follows the app backup tier
+     * // (`backup: { tier }` — on at resilient/enterprise); `versioned` or a
+     * // per-bucket `backupVaultTier` overrides it.
+     * const assets = app.addStorage(StorageFactory.build("Assets"));
      *
      * @example
      * // Website bucket

package/dist/lib/app.js

@@ -48,6 +48,8 @@ export class App extends CdkApp {
     bastion;
     networkDisabled = false;
     globalTags = {};
+    backupTier;
+    backupTierObserved = false;
     aspectApplied = false;
     resourceInventory;
     manifestCollector;
@@ -64,9 +66,9 @@ export class App extends CdkApp {
         // Initialise manifest collector for build-time service discovery
         this.manifestCollector = getManifestCollector(this.name);
         this.initialiseStandardTags();
-        // Apply backup tier tag if configured
+        // Apply backup tier if configured
         if (options?.backup && typeof options.backup === "object") {
-            this.applyBackupTag(options.backup.tier);
+            this.applyBackupTier(options.backup.tier);
         }
         // Initialise network immediately if configured
         if (options?.network === false) {
@@ -83,7 +85,14 @@ export class App extends CdkApp {
             this.eventBusOverride = options.eventBus;
         }
     }
-    applyBackupTag(tier) {
+    applyBackupTier(tier) {
+        if (this.backupTierObserved) {
+            throw new Error(`Backup tier "${tier}" applied after a resource already resolved the app's tier: ` +
+                `that resource would carry the tier's disaster-recovery tag without its versioning default. ` +
+                `Pass \`backup\` on the first App.getApp("${this.name}") call, before addStorage(), ` +
+                `addBuildkite() or a Payload pattern.`);
+        }
+        this.backupTier = tier;
         this.globalTags[BACKUP_TIER_TAG_KEY] = BACKUP_TIER_TAG_MAP[tier];
     }
     initialiseTunnel(config) {
@@ -109,6 +118,17 @@ export class App extends CdkApp {
     getName() {
         return this.name;
     }
+    /**
+     * The app-level backup tier from `backup: { tier }`, or undefined when no
+     * backup is declared. Factories thread it to resources whose defaults derive
+     * from it (S3 versioning); a per-resource `backupVaultTier` overrides it.
+     * Reading it pins the tier: a `backup` applied on a later `getApp` call
+     * throws, so no resource can carry the tier's tag without its defaults.
+     */
+    getBackupTier() {
+        this.backupTierObserved = true;
+        return this.backupTier;
+    }
     static getApp(name, options) {
         return App.getInstance(name, options);
     }
@@ -145,11 +165,11 @@ export class App extends CdkApp {
                 !App.instance.networkDisabled) {
                 App.instance.initialiseNetwork(options.network);
             }
-            // Apply backup tag if configured and not already set
+            // Apply backup tier if configured and not already set
             if (options?.backup &&
                 typeof options.backup === "object" &&
-                !App.instance.globalTags[BACKUP_TIER_TAG_KEY]) {
-                App.instance.applyBackupTag(options.backup.tier);
+                App.instance.backupTier === undefined) {
+                App.instance.applyBackupTier(options.backup.tier);
             }
             // Initialise tunnel if configured and not already created
             if (options?.tunnel && !App.instance.bastion) {
@@ -557,10 +577,10 @@ export class App extends CdkApp {
      * Add a storage resource (S3) to the default storage stack using the factory pattern.
      *
      * @example
-     * // Private bucket (default)
-     * const assets = app.addStorage(StorageFactory.build("Assets", {
-     *   versioned: true
-     * }));
+     * // Private bucket (default). Versioning follows the app backup tier
+     * // (`backup: { tier }` — on at resilient/enterprise); `versioned` or a
+     * // per-bucket `backupVaultTier` overrides it.
+     * const assets = app.addStorage(StorageFactory.build("Assets"));
      *
      * @example
      * // Website bucket

package/dist/lib/patterns/aws/buildkite/buildkite.d.ts

@@ -1,8 +1,14 @@
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
 import { Construct } from "constructs";
+import { type BackupTier } from "../../../utils/backupTierMapping.js";
 import { type BuildkitePropsInput } from "./schema.js";
 export type BuildkiteConstructProps = BuildkitePropsInput & {
     readonly vpc: IVpc;
+    /**
+     * The owning app's backup tier — `BuildkiteFactory` fills it from the App
+     * so the artefact bucket's versioning default follows the tier.
+     */
+    readonly appBackupTier?: BackupTier;
 };
 /**
  * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -37,7 +37,7 @@ export class Buildkite extends Construct {
     autoScalingGroupName;
     constructor(scope, id, props) {
         super(scope, id);
-        const { vpc, ...plainProps } = props;
+        const { vpc, appBackupTier, ...plainProps } = props;
         const config = validateBuildkiteProps(plainProps);
         // Deliberate asymmetry: the agent token is load-bearing (boot + scaler),
         // so underivable throws; the api-key hook and per-pipeline job secrets
@@ -88,10 +88,14 @@ export class Buildkite extends Construct {
                 owner: config.costAllocationOwner
             })
         });
-        const artifactBucket = new S3Bucket(this, `${id}ArtifactBucket`);
+        // Artefacts are write-once keys, so versioning follows the app backup tier
+        // at negligible cost; the bucket is otherwise scratch output and keeps the
+        // wrapper's env-aware default (DESTROY + pre-empty off prod).
+        const artifactBucket = new S3Bucket(this, `${id}ArtifactBucket`, {
+            appBackupTier
+        });
         // Secrets (SSH deploy keys, git credentials) must survive stack teardown
-        // and accidental overwrite; the artifact bucket is scratch output and
-        // keeps the wrapper's env-aware default (DESTROY + pre-empty off prod).
+        // and accidental overwrite.
         const managedSecretsBucket = new S3Bucket(this, `${id}ManagedSecretsBucket`, { versioned: true, removalPolicy: RemovalPolicy.RETAIN });
         if (fjallApiKeyParameterName !== undefined ||
             pipelineSecretsPrefix !== undefined) {

package/dist/lib/patterns/aws/buildkite/factory.d.ts

@@ -10,10 +10,10 @@ import type { BuildkitePropsInput } from "./schema.js";
  */
 export type BuildkiteFactoryFn = (app: App, scope: Construct) => Buildkite;
 /**
- * Resolve construct props from plain-data input: VPC injection plus the three
+ * Resolve construct props from plain-data input: VPC injection plus the
  * app-level defaults (cost-allocation environment, shared alarm topic,
- * applicationId). Single source for both `App.addBuildkite` entry paths
- * (design § D2) — explicit props always win.
+ * applicationId, backup tier). Single source for both `App.addBuildkite`
+ * entry paths (design § D2) — explicit props always win.
  */
 export declare function resolveBuildkiteConstructProps(app: App, props: BuildkitePropsInput): BuildkiteConstructProps;
 /**

package/dist/lib/patterns/aws/buildkite/factory.js

@@ -3,10 +3,10 @@ import { UNKNOWN_ENVIRONMENT } from "../../../utils/env.js";
 import { getConfig } from "../../../utils/getConfig.js";
 import { Buildkite } from "./buildkite.js";
 /**
- * Resolve construct props from plain-data input: VPC injection plus the three
+ * Resolve construct props from plain-data input: VPC injection plus the
  * app-level defaults (cost-allocation environment, shared alarm topic,
- * applicationId). Single source for both `App.addBuildkite` entry paths
- * (design § D2) — explicit props always win.
+ * applicationId, backup tier). Single source for both `App.addBuildkite`
+ * entry paths (design § D2) — explicit props always win.
  */
 export function resolveBuildkiteConstructProps(app, props) {
     const configEnvironment = getConfig().environment;
@@ -24,7 +24,10 @@ export function resolveBuildkiteConstructProps(app, props) {
     if (constructProps.applicationId === undefined) {
         constructProps.applicationId = app.getName();
     }
-    return constructProps;
+    const appBackupTier = app.getBackupTier();
+    return appBackupTier === undefined
+        ? constructProps
+        : { ...constructProps, appBackupTier };
 }
 /**
  * Factory for the self-hosted Buildkite agent fleet — the codemod add path

package/dist/lib/patterns/aws/interfaces/pattern.d.ts

@@ -201,7 +201,12 @@ export interface PayloadComputeConfig {
  * S3 bucket configuration for pattern sub-buckets.
  */
 export interface PatternStorageBucketConfig {
-    /** Enable versioning. Default: false */
+    /**
+     * Bucket versioning. Absent, the pattern decides: the media bucket follows
+     * the app backup tier (on at `resilient`/`enterprise`), while assets (build
+     * output, pruned per deploy) and cache (ISR, regenerated at runtime) stay
+     * off at every tier. An explicit value always wins.
+     */
     versioned?: boolean;
 }
 /**
@@ -210,9 +215,7 @@ export interface PatternStorageBucketConfig {
  *
  * @example
  * storage: {
- *   assets: { versioned: true },
- *   cache: { versioned: false },
- *   media: { versioned: true }
+ *   media: { versioned: true } // force on below the resilient tier
  * }
  */
 export interface PayloadStorageConfig {

package/dist/lib/patterns/aws/payload.js

@@ -219,6 +219,7 @@ export class Payload extends Construct {
     createAssetsBucket() {
         const assetsConfig = this.props.storage?.assets ?? {};
         const assetsProps = {
+            // Build output, pruned on every deploy — versioning would only bill for churn.
             versioned: assetsConfig.versioned ?? false,
             deployment: {
                 source: `${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.ASSETS}`,
@@ -234,6 +235,7 @@ export class Payload extends Construct {
     createCacheBucket() {
         const cacheConfig = this.props.storage?.cache ?? {};
         const cacheProps = {
+            // ISR cache, regenerated at runtime — versioning would only bill for churn.
             versioned: cacheConfig.versioned ?? false,
             deployment: {
                 source: `${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.CACHE}`,
@@ -244,8 +246,11 @@ export class Payload extends Construct {
     }
     createMediaBucket() {
         const mediaConfig = this.props.storage?.media ?? {};
+        // Customer uploads: versioning follows the app backup tier unless set here.
         const mediaProps = {
-            versioned: mediaConfig.versioned ?? false
+            ...(mediaConfig.versioned !== undefined && {
+                versioned: mediaConfig.versioned
+            })
         };
         return this.app.addStorage(StorageFactory.build(`${this.props.name}-media`, mediaProps));
     }

package/dist/lib/patterns/aws/storage.d.ts

@@ -33,6 +33,11 @@ export interface S3Props {
     readonly bucketName?: string;
     readonly publicReadAccess?: boolean;
     readonly websiteHosting?: WebsiteHostingConfig;
+    /**
+     * Bucket versioning. Defaults from the effective backup tier — the
+     * per-bucket `backupVaultTier`, else the app's `backup: { tier }` — on at
+     * `resilient`/`enterprise`, off otherwise. An explicit value always wins.
+     */
     readonly versioned?: boolean;
     readonly encryption?: "AES256" | "KMS";
     readonly kmsKeyArn?: string;
@@ -42,6 +47,10 @@ export interface S3Props {
      * false to opt out. Ignored for non-KMS encryption.
      */
     readonly bucketKeyEnabled?: boolean;
+    /**
+     * Per-bucket backup tier override. Beats the app-level tier for both the
+     * `fjall:disasterRecovery:tier` tag and the versioning default.
+     */
     readonly backupVaultTier?: BackupTier;
     readonly cors?: CorsRule[];
     readonly deployment?: S3DeploymentConfig;
@@ -64,6 +73,12 @@ export interface S3Props {
      * construction.
      */
     readonly appName?: string;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the versioning default follows. `StorageFactory` fills it from the App as
+     * it does `appName`; pass it only for direct `new Storage(...)` construction.
+     */
+    readonly appBackupTier?: BackupTier;
 }
 export interface StorageBuildProps extends S3Props {
     readonly stackPlacement?: "storage" | "cdn" | "compute";

package/dist/lib/patterns/aws/storage.js

@@ -84,6 +84,7 @@ export class Storage extends Construct {
                 bucketKeyEnabled: props.bucketKeyEnabled
             }),
             backupVaultTier: props.backupVaultTier,
+            appBackupTier: props.appBackupTier,
             publicReadAccess: props.publicReadAccess,
             websiteHosting: props.websiteHosting,
             resourcePolicyStatements: props.resourcePolicyStatements,
@@ -218,12 +219,14 @@ export class StorageFactory {
         const { stackPlacement, ...s3Props } = props;
         const fn = (app, scope) => {
             validateStorageProps(s3Props);
-            // The App is the only place the app name is known here; website-hosting
-            // buckets need it for their (app, bucket)-keyed exports — the same fill
-            // CdnFactory performs for Cdn.
+            // The App is the only place the app name and backup tier are known
+            // here: website-hosting buckets need the name for their (app,
+            // bucket)-keyed exports (the same fill CdnFactory performs for Cdn), and
+            // the bucket's versioning default follows the tier.
             return new Storage(scope, id, {
                 ...s3Props,
-                appName: s3Props.appName ?? app.getName()
+                appName: s3Props.appName ?? app.getName(),
+                appBackupTier: s3Props.appBackupTier ?? app.getBackupTier()
             });
         };
         if (stackPlacement) {

package/dist/lib/resources/aws/storage/s3.d.ts

@@ -46,7 +46,19 @@ export interface ResourcePolicyStatement {
  * `bucketKeyEnabled: true` (pass `false` to opt out).
  */
 export interface S3BucketProps extends BucketProps {
+    /**
+     * Per-bucket backup tier override. Beats `appBackupTier` for both the
+     * `fjall:disasterRecovery:tier` tag and the versioning default.
+     */
     backupVaultTier?: BackupTier;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`). The
+     * versioning default follows the effective tier — this, unless
+     * `backupVaultTier` overrides it — on at `resilient`/`enterprise`. The
+     * `StorageFactory` and `BuildkiteFactory` paths fill it from the App; only
+     * direct `new S3Bucket` construction needs to pass it.
+     */
+    appBackupTier?: BackupTier;
     publicReadAccess?: boolean;
     websiteHosting?: WebsiteHostingConfig;
     /**
@@ -80,5 +92,7 @@ export interface S3BucketProps extends BucketProps {
 }
 export declare class S3Bucket extends Bucket {
     readonly backupVaultTier?: BackupTier;
+    /** The tier the bucket runs under: `backupVaultTier`, else `appBackupTier`. */
+    readonly effectiveBackupTier?: BackupTier;
     constructor(scope: Construct, id: string, props?: S3BucketProps);
 }

package/dist/lib/resources/aws/storage/s3.js

@@ -3,6 +3,7 @@ import { Annotations, CfnOutput, Duration, RemovalPolicy, Tags } from "aws-cdk-l
 import { BlockPublicAccess, Bucket, BucketEncryption } from "aws-cdk-lib/aws-s3";
 import { ArnPrincipal, Effect, PolicyStatement, StarPrincipal } from "aws-cdk-lib/aws-iam";
 import { RegionInfo } from "aws-cdk-lib/region-info";
+import { resolveEffectiveBackupTier, shouldAutoVersion } from "../../../utils/backupTierMapping.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { bucketWebsiteEndpointExportName, bucketWebsiteHostedZoneIdExportName } from "@fjall/util";
 import { envAwareRemovalPolicyDefault, toRemovalPolicy } from "../../../utils/removalPolicy.js";
@@ -15,9 +16,6 @@ export { SDK_PRE_EMPTY_TAG_KEY } from "@fjall/util/aws";
  * every site so the retention window cannot drift.
  */
 export const NONCURRENT_VERSION_EXPIRY_DAYS = 30;
-function shouldAutoVersion(tier) {
-    return tier === "resilient" || tier === "enterprise";
-}
 function toResourcePolicyPrincipal(identifier) {
     return identifier === "*"
         ? new StarPrincipal()
@@ -25,10 +23,13 @@ function toResourcePolicyPrincipal(identifier) {
 }
 export class S3Bucket extends Bucket {
     backupVaultTier;
+    /** The tier the bucket runs under: `backupVaultTier`, else `appBackupTier`. */
+    effectiveBackupTier;
     constructor(scope, id, props = {}) {
-        const { websiteHosting, backupVaultTier, resourcePolicyStatements, aliasTargetName, appName, ...cdkProps } = props;
+        const { websiteHosting, backupVaultTier, appBackupTier, resourcePolicyStatements, aliasTargetName, appName, ...cdkProps } = props;
         const isPublic = props.publicReadAccess === true || websiteHosting !== undefined;
-        const versioned = props.versioned ?? shouldAutoVersion(backupVaultTier);
+        const effectiveBackupTier = resolveEffectiveBackupTier(backupVaultTier, appBackupTier);
+        const versioned = props.versioned ?? shouldAutoVersion(effectiveBackupTier);
         const removalPolicy = props.removalPolicy ?? toRemovalPolicy(envAwareRemovalPolicyDefault());
         // Mirrors the CDK Bucket's own resolution: an encryptionKey with no
         // explicit encryption infers KMS. DSSE is excluded deliberately — S3
@@ -86,6 +87,7 @@ export class S3Bucket extends Bucket {
             ]
         });
         this.backupVaultTier = backupVaultTier;
+        this.effectiveBackupTier = effectiveBackupTier;
         for (const statement of resourcePolicyStatements ?? []) {
             this.addToResourcePolicy(new PolicyStatement({
                 ...(statement.sid !== undefined && { sid: statement.sid }),

package/dist/lib/utils/backupTierMapping.d.ts

@@ -5,7 +5,16 @@ export type BackupTier = "standard" | "resilient" | "enterprise";
 /**
  * Shared mapping from application backup tier names to AWS Backup plan tag values.
  *
- * Used by both App.applyBackupTag() (app-level tag) and StandardTagsAspect
- * (per-resource override tag) to ensure consistent tier → tag translation.
+ * Used by both App.applyBackupTier() (app-level tag) and StandardTagsAspect
+ * (per-resource tag) to ensure consistent tier → tag translation.
  */
 export declare const BACKUP_TIER_TAG_MAP: Readonly<Record<BackupTier, string>>;
+/**
+ * The tier a resource actually runs under: its own override, else the
+ * app-level tier `App.getApp({ backup: { tier } })` declared. The single
+ * resolution every tier-derived default reads (S3 versioning, the DR tag),
+ * so the derivations cannot drift.
+ */
+export declare function resolveEffectiveBackupTier(resourceTier: BackupTier | undefined, appTier: BackupTier | undefined): BackupTier | undefined;
+/** Tiers whose S3 buckets version by default. */
+export declare function shouldAutoVersion(tier: BackupTier | undefined): boolean;

package/dist/lib/utils/backupTierMapping.js

@@ -3,11 +3,24 @@ export const BACKUP_TIER_TAG_KEY = "fjall:disasterRecovery:tier";
 /**
  * Shared mapping from application backup tier names to AWS Backup plan tag values.
  *
- * Used by both App.applyBackupTag() (app-level tag) and StandardTagsAspect
- * (per-resource override tag) to ensure consistent tier → tag translation.
+ * Used by both App.applyBackupTier() (app-level tag) and StandardTagsAspect
+ * (per-resource tag) to ensure consistent tier → tag translation.
  */
 export const BACKUP_TIER_TAG_MAP = Object.freeze({
     standard: "default",
     resilient: "resilient",
     enterprise: "enterprise"
 });
+/**
+ * The tier a resource actually runs under: its own override, else the
+ * app-level tier `App.getApp({ backup: { tier } })` declared. The single
+ * resolution every tier-derived default reads (S3 versioning, the DR tag),
+ * so the derivations cannot drift.
+ */
+export function resolveEffectiveBackupTier(resourceTier, appTier) {
+    return resourceTier ?? appTier;
+}
+/** Tiers whose S3 buckets version by default. */
+export function shouldAutoVersion(tier) {
+    return tier === "resilient" || tier === "enterprise";
+}

package/dist/lib/utils/standardTagsAspect.d.ts

@@ -22,10 +22,13 @@ export declare class StandardTagsAspect implements IAspect {
      */
     private addIpamPoolTag;
     /**
-     * Add disaster recovery tier tag to S3 buckets with backupVaultTier property.
-     * This serves as a per-resource override when `backupVaultTier` is set on a
-     * specific S3 bucket. CDK child tags override parent tags, so this takes
-     * precedence over the app-level backup tag set via `App.getApp({ backup })`.
+     * Add the disaster recovery tier tag to S3 buckets from the bucket's
+     * effective tier — the per-bucket `backupVaultTier` override, else the
+     * app-level tier the factory threaded in. CDK child tags override parent
+     * tags, so an override wins over the app-level tag set via
+     * `App.getApp({ backup })`; an inherited app tier writes the value that tag
+     * already carries. The same resolution decides the bucket's versioning
+     * default (`S3Bucket`).
      *
      * Tag format: fjall:disasterRecovery:tier = "{tier}"
      *

package/dist/lib/utils/standardTagsAspect.js

@@ -54,10 +54,13 @@ export class StandardTagsAspect {
         }
     }
     /**
-     * Add disaster recovery tier tag to S3 buckets with backupVaultTier property.
-     * This serves as a per-resource override when `backupVaultTier` is set on a
-     * specific S3 bucket. CDK child tags override parent tags, so this takes
-     * precedence over the app-level backup tag set via `App.getApp({ backup })`.
+     * Add the disaster recovery tier tag to S3 buckets from the bucket's
+     * effective tier — the per-bucket `backupVaultTier` override, else the
+     * app-level tier the factory threaded in. CDK child tags override parent
+     * tags, so an override wins over the app-level tag set via
+     * `App.getApp({ backup })`; an inherited app tier writes the value that tag
+     * already carries. The same resolution decides the bucket's versioning
+     * default (`S3Bucket`).
      *
      * Tag format: fjall:disasterRecovery:tier = "{tier}"
      *
@@ -70,8 +73,8 @@ export class StandardTagsAspect {
         let construct = resource;
         while (construct) {
             const backupConstruct = construct;
-            if (backupConstruct.backupVaultTier) {
-                const tier = backupConstruct.backupVaultTier;
+            if (backupConstruct.effectiveBackupTier) {
+                const tier = backupConstruct.effectiveBackupTier;
                 const tagValue = BACKUP_TIER_TAG_MAP[tier];
                 Tags.of(resource).add(BACKUP_TIER_TAG_KEY, tagValue);
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "28.4.0",
+  "version": "30.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -78,8 +78,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^28.4.0",
-    "@fjall/util": "^28.4.0",
+    "@fjall/generator": "^30.0.0",
+    "@fjall/util": "^30.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },