@fjall/components-infrastructure 3.0.0 → 3.2.1

package/dist/lib/patterns/aws/devSubstrate.d.ts

@@ -40,27 +40,38 @@ export interface IDevSubstrateProps {
     readonly adoptSlotEcr?: boolean;
     /**
      * Deploy phase for the R2 two-step cert-hang guard. `"zone"` synthesises the
-     * `dev.<appDomain>` child zone + cross-account NS delegation only; `"full"`
-     * additionally builds the wildcard cert + :443 listener (A6) — deploy that
-     * only after the delegated NS has propagated, else ACM DNS-validation hangs.
-     * Defaults to `"full"`. Inert unless `domain` is set.
+     * `devDomain` zone + cross-account NS delegation only; `"full"` additionally
+     * builds the wildcard cert + :443 listener (A6) — deploy that only after the
+     * delegated NS has propagated, else ACM DNS-validation hangs. Defaults to
+     * `"full"`. Inert unless `domain` is set.
      */
     readonly phase?: DomainDeployPhase;
     /**
-     * Public domain the substrate hangs a `dev.<appDomain>` child zone under. When
-     * omitted, the substrate stands up no zone/cert (early milestone — G2 reaches
-     * slots via `curl --resolve`).
+     * The zone slots serve under — an EXPLICIT name (`devDomain`, e.g.
+     * `development.fjall.io`), never derived by prefixing. When omitted, the
+     * substrate stands up no zone/cert (early milestone — G2 reaches slots via
+     * `curl --resolve`).
      *
-     * `parentDelegationRoleArn`, when present, wires the same-org **Case-1** in-stack
-     * NS delegation (design VD2-a): the child stack's `CrossAccountZoneDelegationRecord`
-     * assumes the parent account's `DelegationRole` by LITERAL ARN and UPSERTs the
-     * child NS into the parent zone. Omit it for a plain externally-owned parent
-     * (Case 3 — manual one-off delegation) or a connected different-org parent
-     * (Case 2 — worker UPSERT, B3b, deferred): the substrate then emits only the
-     * zone + its NS export for out-of-band delegation.
+     * Adopt mode (`hostedZoneId` present): the substrate adopts an existing zone
+     * (e.g. the account's delegated Domain) by import — no zone resource, no
+     * delegation record, no NS export. Mutually exclusive with `parentDomain` /
+     * `parentDelegationRoleArn`.
+     *
+     * Create mode (no `hostedZoneId`): the substrate creates the `devDomain`
+     * zone. `parentDelegationRoleArn`, when present, wires the same-org **Case-1**
+     * in-stack NS delegation (design VD2-a): the child stack's
+     * `CrossAccountZoneDelegationRecord` assumes the parent account's
+     * `DelegationRole` by LITERAL ARN and UPSERTs the child NS into the
+     * `parentDomain` zone — `parentDomain` (a proper DNS suffix of `devDomain`)
+     * MUST accompany it. Omit both for a plain externally-owned parent (Case 3 —
+     * manual one-off delegation) or a connected different-org parent (Case 2 —
+     * worker UPSERT, B3b, deferred): the substrate then emits only the zone + its
+     * NS export for out-of-band delegation.
      */
     readonly domain?: {
-        readonly appDomain: string;
+        readonly devDomain: string;
+        readonly hostedZoneId?: string;
+        readonly parentDomain?: string;
         readonly parentDelegationRoleArn?: string;
     };
 }

package/dist/lib/patterns/aws/devSubstrate.js

@@ -4,6 +4,7 @@ import { Cluster } from "aws-cdk-lib/aws-ecs";
 import { Repository } from "aws-cdk-lib/aws-ecr";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
+import { PublicHostedZone } from "aws-cdk-lib/aws-route53";
 import { SqsDestination } from "aws-cdk-lib/aws-s3-notifications";
 import { Construct } from "constructs";
 import { readFileSync } from "node:fs";
@@ -48,7 +49,7 @@ const DEV_SUBSTRATE_WAKER_ID = "DevSubstrateWaker";
 const DEV_SUBSTRATE_WAKER_TG_ID = "DevSubstrateWakerTargetGroup";
 const DEV_SUBSTRATE_WAKER_SOURCE_FILE = "devSubstrate.waker.source.cjs";
 const DEV_SUBSTRATE_WAKER_TIMEOUT_SECONDS = 30;
-/** Construct ids for the substrate's delegated `dev.<appDomain>` child zone. */
+/** Construct ids for the substrate's `devDomain` slot zone (created or adopted). */
 const DEV_SUBSTRATE_ZONE_ID = "DevSubstrateZone";
 const DEV_SUBSTRATE_DELEGATION_ID = "DevSubstrateDelegation";
 const DEV_SUBSTRATE_PARENT_ROLE_ID = "DevSubstrateParentDelegationRole";
@@ -306,32 +307,51 @@ export class DevSubstrate extends Construct {
     #createDomain(props, loadBalancer) {
         if (props.domain === undefined)
             return {};
-        const { appDomain, parentDelegationRoleArn } = props.domain;
-        const childZoneName = `dev.${appDomain}`;
-        // The delegated child zone: createDelegationRole:false because the PARENT
-        // account owns the delegation role (this is the child). The HostedZone
-        // wrapper's create path auto-emits the `<zone>-nameservers` CFN export the
-        // parent consumes to point NS records at us — no manual export needed.
-        const childZone = new HostedZone(this, DEV_SUBSTRATE_ZONE_ID, {
-            zoneName: childZoneName,
-            createDelegationRole: false
-        });
-        // Case-1 same-org delegation fires only when a parent role ARN is supplied.
-        // The in-stack custom resource assumes the parent account's DelegationRole by
-        // LITERAL ARN (Role.fromRoleArn) — NOT Fn.importValue, which resolves
-        // same-account only and is exactly why the DomainDelegation pattern cannot go
-        // cross-account (design VD2-a). The parent DelegationRole trusts the whole
-        // org (OrganizationPrincipal), so a sibling dev account can assume it. Absent
-        // ARN ⇒ Case 2 (worker UPSERT, B3b) / Case 3 (manual), handled out of band:
-        // the zone + NS export above is all the substrate emits.
-        if (parentDelegationRoleArn !== undefined) {
-            const parentRole = Role.fromRoleArn(this, DEV_SUBSTRATE_PARENT_ROLE_ID, parentDelegationRoleArn);
-            new CrossAccountDelegationRecord(this, DEV_SUBSTRATE_DELEGATION_ID, {
-                delegationRole: parentRole,
-                delegatedZone: childZone.hostedZone,
-                delegatedZoneName: childZoneName,
-                parentHostedZoneName: appDomain
+        const { devDomain, hostedZoneId, parentDomain, parentDelegationRoleArn } = props.domain;
+        const childZoneName = devDomain;
+        let childZone;
+        if (hostedZoneId !== undefined) {
+            // Adopt mode: import only — no zone resource, no delegation record, no NS
+            // export (the zone's NS was delegated when the account Domain deployed).
+            // Plain CDK import, NOT the HostedZone wrapper: its import path re-emits
+            // the global `<zone>-hosted-zone-id` export, colliding with the owning
+            // Domain stack's.
+            childZone = PublicHostedZone.fromHostedZoneAttributes(this, DEV_SUBSTRATE_ZONE_ID, { hostedZoneId, zoneName: childZoneName });
+        }
+        else {
+            // Create mode: createDelegationRole:false because the PARENT account owns
+            // the delegation role (this is the child). The HostedZone wrapper's create
+            // path auto-emits the `<zone>-nameservers` CFN export the parent consumes
+            // to point NS records at us — no manual export needed.
+            const createdZone = new HostedZone(this, DEV_SUBSTRATE_ZONE_ID, {
+                zoneName: childZoneName,
+                createDelegationRole: false
             });
+            childZone = createdZone.hostedZone;
+            // Case-1 same-org delegation fires only when a parent role ARN is supplied.
+            // The in-stack custom resource assumes the parent account's DelegationRole by
+            // LITERAL ARN (Role.fromRoleArn) — NOT Fn.importValue, which resolves
+            // same-account only and is exactly why the DomainDelegation pattern cannot go
+            // cross-account (design VD2-a). The parent DelegationRole trusts the whole
+            // org (OrganizationPrincipal), so a sibling dev account can assume it. Absent
+            // ARN ⇒ Case 2 (worker UPSERT, B3b) / Case 3 (manual), handled out of band:
+            // the zone + NS export above is all the substrate emits.
+            if (parentDelegationRoleArn !== undefined) {
+                // Re-checked here because direct construct calls bypass the Zod schema.
+                if (parentDomain === undefined) {
+                    throw new Error(`DevSubstrate domain "${devDomain}": parentDelegationRoleArn was ` +
+                        `supplied without parentDomain. Set domain.parentDomain to the ` +
+                        `parent zone the DelegationRole belongs to (a proper DNS suffix ` +
+                        `of devDomain), or omit parentDelegationRoleArn.`);
+                }
+                const parentRole = Role.fromRoleArn(this, DEV_SUBSTRATE_PARENT_ROLE_ID, parentDelegationRoleArn);
+                new CrossAccountDelegationRecord(this, DEV_SUBSTRATE_DELEGATION_ID, {
+                    delegationRole: parentRole,
+                    delegatedZone: childZone,
+                    delegatedZoneName: childZoneName,
+                    parentHostedZoneName: parentDomain
+                });
+            }
         }
         // Step 2 of the R2 two-step gate: synthesising the cert before the step-1 NS
         // has propagated hangs ACM DNS-validation for hours, so "zone" stops here.
@@ -342,7 +362,7 @@ export class DevSubstrate extends Construct {
         // would otherwise render an invalid CFN export name.
         const certificate = new DomainCertificate(this, DEV_SUBSTRATE_CERT_ID, {
             domainName: `*.${childZoneName}`,
-            hostedZone: childZone.hostedZone,
+            hostedZone: childZone,
             exportCertificateArn: false
         });
         // Unconditional 404 as on :80 (per-slot rules attach out of band, §5.4). open

package/dist/lib/resources/aws/compute/ec2.d.ts

@@ -122,6 +122,21 @@ export interface Ec2InstanceProps extends StackProps {
      * keys or values are rejected by `validateEc2InstanceProps`.
      */
     tags?: Record<string, string>;
+    /**
+     * CDK `AutoScalingGroupProps.maxInstanceLifetime` verbatim — ASG replaces
+     * instances older than this. CDK enforces the AWS 1–365 day bounds at
+     * synth. Absent → no lifetime cap (AWS default).
+     */
+    maxInstanceLifetime?: Duration;
+    /**
+     * CDK `AutoScalingGroupProps.ssmSessionPermissions`. Absent → `true`
+     * (existing wrapper behaviour). `true` attaches the
+     * `AmazonSSMManagedInstanceCore` managed policy to the instance role —
+     * which carries account-wide `ssm:GetParameter`. Least-privilege consumers
+     * that supply their own role with scoped Session Manager statements
+     * (Buildkite agents) pass `false` and keep the role allowlist-only.
+     */
+    ssmSessionPermissions?: boolean;
 }
 export declare class Ec2Instance extends Construct implements IConnectable {
     private launchTemplate;

package/dist/lib/resources/aws/compute/ec2.js

@@ -151,6 +151,9 @@ export class Ec2Instance extends Construct {
             ...(props.capacityRebalance !== undefined && {
                 capacityRebalance: props.capacityRebalance
             }),
+            ...(props.maxInstanceLifetime !== undefined && {
+                maxInstanceLifetime: props.maxInstanceLifetime
+            }),
             cooldown: Duration.seconds(60),
             groupMetrics: [GroupMetrics.all()],
             ...(resolvedUpdatePolicy !== undefined && {
@@ -165,7 +168,7 @@ export class Ec2Instance extends Construct {
                 TerminationPolicy.OLDEST_LAUNCH_CONFIGURATION,
                 TerminationPolicy.CLOSEST_TO_NEXT_INSTANCE_HOUR
             ],
-            ssmSessionPermissions: true
+            ssmSessionPermissions: props.ssmSessionPermissions ?? true
         };
         // Support spot instances via mixed instances policy
         if (props.spotCapacityPercentage !== undefined &&
@@ -262,6 +265,22 @@ export class Ec2Instance extends Construct {
     }
 }
 function validateEc2InstanceProps(props) {
+    if (props.spotCapacityPercentage !== undefined) {
+        if (!Number.isInteger(props.spotCapacityPercentage) ||
+            props.spotCapacityPercentage < 0 ||
+            props.spotCapacityPercentage > 100) {
+            throw new Error(`Ec2Instance.spotCapacityPercentage must be an integer between 0 and 100; got ${props.spotCapacityPercentage}`);
+        }
+    }
+    if (props.minCapacity !== undefined &&
+        (!Number.isInteger(props.minCapacity) || props.minCapacity < 0)) {
+        throw new Error(`Ec2Instance.minCapacity must be a non-negative integer; got ${props.minCapacity}`);
+    }
+    if (props.maxCapacity !== undefined &&
+        props.minCapacity !== undefined &&
+        props.maxCapacity < props.minCapacity) {
+        throw new Error(`Ec2Instance.maxCapacity (${props.maxCapacity}) must be >= minCapacity (${props.minCapacity})`);
+    }
     if (props.persistentDataVolume !== undefined) {
         const azs = props.vpcSubnets?.availabilityZones;
         if (azs === undefined || azs.length !== 1) {

package/dist/lib/resources/aws/monitoring/buildkiteAlarms.d.ts

@@ -0,0 +1,29 @@
+import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import type { ITopic } from "aws-cdk-lib/aws-sns";
+import type { Construct } from "constructs";
+export interface BuildkiteAlarmsProps {
+    scope: Construct;
+    buildkiteOrgSlug: string;
+    buildkiteQueue: string;
+    autoScalingGroupName: string;
+    /**
+     * Omitted → the alarms exist on the console but page nobody. Unlike the
+     * sibling builders the topic is optional: `App.addBuildkite` defaults it to
+     * the shared platform topic, and a bare construct must still synth.
+     */
+    alarmTopic?: ITopic;
+    applicationId?: string;
+}
+/**
+ * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
+ * posture is honest only with these:
+ *
+ * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
+ *    The scaler publishes every poll, so metric absence means the scaler
+ *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
+ *    entire mechanism.
+ * 2. Queued with zero capacity — jobs scheduled while the ASG has no
+ *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
+ *    quota, subnet failure) while work is waiting.
+ */
+export declare function createBuildkiteAlarms(props: BuildkiteAlarmsProps): Alarm[];

package/dist/lib/resources/aws/monitoring/buildkiteAlarms.js

@@ -0,0 +1,90 @@
+import { Duration } from "aws-cdk-lib";
+import { Alarm, ComparisonOperator, MathExpression, Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
+import { buildAlarmDescription, registerAlarm, tagAlarmsWithApplicationId } from "./alarmDefaults.js";
+/**
+ * Metrics namespace the buildkite-agent-scaler publishes to, dimensioned by
+ * {Org, Queue} — BOTH dimensions are required; querying Queue alone reads no
+ * data (CloudWatch dimension matching is exact-set), leaving the heartbeat
+ * permanently ALARM and the queued alarm permanently inert. Phase-1b rollout
+ * gate: verify both metrics carry data after the first build before trusting
+ * the alarms (design § D13/D14) — a namespace/dimension mismatch here is
+ * invisible to the synth tests.
+ */
+const SCALER_METRICS_NAMESPACE = "Buildkite";
+/**
+ * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
+ * posture is honest only with these:
+ *
+ * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
+ *    The scaler publishes every poll, so metric absence means the scaler
+ *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
+ *    entire mechanism.
+ * 2. Queued with zero capacity — jobs scheduled while the ASG has no
+ *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
+ *    quota, subnet failure) while work is waiting.
+ */
+export function createBuildkiteAlarms(props) {
+    const { scope, buildkiteOrgSlug, buildkiteQueue, autoScalingGroupName, alarmTopic, applicationId } = props;
+    const alarms = [];
+    const snsAction = alarmTopic !== undefined ? new SnsAction(alarmTopic) : undefined;
+    const scheduledJobs = new Metric({
+        namespace: SCALER_METRICS_NAMESPACE,
+        metricName: "ScheduledJobsCount",
+        dimensionsMap: {
+            Org: buildkiteOrgSlug,
+            Queue: buildkiteQueue
+        },
+        statistic: "Maximum",
+        period: Duration.minutes(5)
+    });
+    const heartbeatAlarm = new Alarm(scope, "ScalerHeartbeatAlarm", {
+        alarmDescription: buildAlarmDescription(`Buildkite scaler for queue '${buildkiteQueue}' has stopped ` +
+            "publishing metrics — scaler Lambda dead or erroring. Jobs will " +
+            "queue with no scale-out.", applicationId),
+        metric: scheduledJobs,
+        comparisonOperator: ComparisonOperator.LESS_THAN_THRESHOLD,
+        threshold: 0,
+        evaluationPeriods: 3,
+        treatMissingData: TreatMissingData.BREACHING
+    });
+    if (snsAction !== undefined) {
+        registerAlarm(heartbeatAlarm, snsAction, alarms);
+    }
+    else {
+        alarms.push(heartbeatAlarm);
+    }
+    const inServiceInstances = new Metric({
+        namespace: "AWS/AutoScaling",
+        metricName: "GroupInServiceInstances",
+        dimensionsMap: { AutoScalingGroupName: autoScalingGroupName },
+        statistic: "Maximum",
+        period: Duration.minutes(5)
+    });
+    const queuedWithZeroCapacity = new MathExpression({
+        expression: "IF(scheduled > 0 AND inService == 0, 1, 0)",
+        usingMetrics: {
+            scheduled: scheduledJobs,
+            inService: inServiceInstances
+        },
+        period: Duration.minutes(5)
+    });
+    const queuedAlarm = new Alarm(scope, "QueuedWithZeroCapacityAlarm", {
+        alarmDescription: buildAlarmDescription(`Buildkite queue '${buildkiteQueue}' has scheduled jobs but zero ` +
+            "in-service agents for 15 minutes — the fleet cannot boot (AMI, " +
+            "quota, or subnet failure) while work waits.", applicationId),
+        metric: queuedWithZeroCapacity,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 1,
+        evaluationPeriods: 3,
+        treatMissingData: TreatMissingData.NOT_BREACHING
+    });
+    if (snsAction !== undefined) {
+        registerAlarm(queuedAlarm, snsAction, alarms);
+    }
+    else {
+        alarms.push(queuedAlarm);
+    }
+    tagAlarmsWithApplicationId(alarms, applicationId);
+    return alarms;
+}

package/dist/lib/resources/aws/monitoring/index.d.ts

@@ -4,5 +4,6 @@ export { createRdsAlarms, type RdsAlarmThresholds, type RdsAlarmsProps } from ".
 export { createLambdaAlarms, type LambdaAlarmThresholds, type LambdaAlarmsProps } from "./lambdaAlarms.js";
 export { createScheduleAlarms, type ScheduleAlarmThresholds, type CreateScheduleAlarmsProps } from "./scheduleAlarms.js";
 export { createClickHouseAlarms, type ClickHouseAlarmThresholds, type ClickHouseAlarmsProps } from "./clickhouseAlarms.js";
+export { createBuildkiteAlarms, type BuildkiteAlarmsProps } from "./buildkiteAlarms.js";
 export { createLogPatternAlarms, type LogPatternAlarmSpec, type LogPatternAlarmsProps } from "./logPatternAlarms.js";
 export { METRIC_NAMESPACE, type MetricNamespace } from "./metricNamespaces.js";

package/dist/lib/resources/aws/monitoring/index.js

@@ -4,5 +4,6 @@ export { createRdsAlarms } from "./rdsAlarms.js";
 export { createLambdaAlarms } from "./lambdaAlarms.js";
 export { createScheduleAlarms } from "./scheduleAlarms.js";
 export { createClickHouseAlarms } from "./clickhouseAlarms.js";
+export { createBuildkiteAlarms } from "./buildkiteAlarms.js";
 export { createLogPatternAlarms } from "./logPatternAlarms.js";
 export { METRIC_NAMESPACE } from "./metricNamespaces.js";

package/dist/lib/resources/aws/networking/hostedZone.js

@@ -13,6 +13,9 @@ export class HostedZoneFactory {
         return new HostedZone(stack.getStack(), `${safeZone}HostedZone`, {
             hostedZoneId,
             zoneName,
+            // BYO app-stack imports never mint the role: its fixed RoleName would
+            // collide with the domain stack's own DelegationRole in the same account.
+            createDelegationRole: false,
             costAllocationEnvironment: opts?.costAllocationEnvironment,
             costAllocationDomain: opts?.costAllocationDomain,
             description: opts?.description
@@ -56,25 +59,6 @@ export class HostedZone extends Construct {
                 value: Fn.join(",", created.hostedZoneNameServers ?? []),
                 exportName: exportNames.nameservers
             });
-            // Org-gate: a single account has no OrganisationId export, so an org-trusting
-            // delegation role would leave an unresolved Fn::ImportValue and roll the stack
-            // back. Default follows org presence; explicit `true` opts in (and fails fast).
-            const inOrganisation = resolveOrgId(this.node) !== undefined;
-            if (props.createDelegationRole === true && !inOrganisation) {
-                throw new Error(`HostedZone "${props.zoneName}": createDelegationRole was requested but ` +
-                    `this account is not part of an AWS Organization (no "orgId" context). ` +
-                    `Cross-account DNS delegation requires an organisation — omit ` +
-                    `createDelegationRole for single-account setups, or connect an organisation.`);
-            }
-            if (props.createDelegationRole ?? inOrganisation) {
-                this.delegationRole = new DelegationRole(this, `${safeZone}DelegationRole`, {
-                    zoneName: props.zoneName,
-                    hostedZone: created,
-                    organisationIdExportName: props.organisationIdExportName,
-                    costAllocationEnvironment: props.costAllocationEnvironment,
-                    costAllocationDomain: props.costAllocationDomain
-                });
-            }
         }
         else {
             // Import path — `fromHostedZoneAttributes` creates a reference, not a
@@ -88,6 +72,26 @@ export class HostedZone extends Construct {
             this.isImported = true;
             Tags.of(this).add("fjall:description", this.description);
         }
+        // Org-gate: a single account has no OrganisationId export, so an org-trusting
+        // delegation role would leave an unresolved Fn::ImportValue and roll the stack
+        // back. Default follows org presence; explicit `true` opts in (and fails fast).
+        // Runs for created AND adopted zones — `grantDelegation` is on IHostedZone.
+        const inOrganisation = resolveOrgId(this.node) !== undefined;
+        if (props.createDelegationRole === true && !inOrganisation) {
+            throw new Error(`HostedZone "${props.zoneName}": createDelegationRole was requested but ` +
+                `this account is not part of an AWS Organization (no "orgId" context). ` +
+                `Cross-account DNS delegation requires an organisation — omit ` +
+                `createDelegationRole for single-account setups, or connect an organisation.`);
+        }
+        if (props.createDelegationRole ?? inOrganisation) {
+            this.delegationRole = new DelegationRole(this, `${safeZone}DelegationRole`, {
+                zoneName: props.zoneName,
+                hostedZone: this.hostedZone,
+                organisationIdExportName: props.organisationIdExportName,
+                costAllocationEnvironment: props.costAllocationEnvironment,
+                costAllocationDomain: props.costAllocationDomain
+            });
+        }
         applyCostAllocationTags(this, {
             service: "hostedZone",
             domain: props.costAllocationDomain ?? props.zoneName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.0.0",
+  "version": "3.2.1",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.0.0",
-    "@fjall/util": "^3.0.0",
+    "@fjall/generator": "^3.2.1",
+    "@fjall/util": "^3.2.1",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "848a386e3e2244401b76faabd02818c682d231e8"
+  "gitHead": "1a249298df7bf3104d9d49b47700234db815ebb1"
 }