@fjall/components-infrastructure 3.2.1 → 3.4.1

package/dist/lib/app.d.ts

@@ -16,7 +16,7 @@ import { type RemovalPolicyString } from "./resources/aws/messaging/utils.js";
 import { type ServiceRegistrationProps } from "./resources/aws/networking/serviceDiscovery.js";
 import { type IPrivateDnsNamespace, type IService } from "aws-cdk-lib/aws-servicediscovery";
 import { type AnyCompute } from "./patterns/aws/compute.js";
-import { Buildkite, type BuildkitePropsInput } from "./patterns/aws/buildkite.js";
+import { type Buildkite, type BuildkiteFactoryFn, type BuildkitePropsInput } from "./patterns/aws/buildkite.js";
 import { DevSubstrate, type IDevSubstrateProps } from "./patterns/aws/devSubstrate.js";
 import { type Storage, type StorageFactoryFn } from "./patterns/aws/storage.js";
 import { type AnyPattern, type PatternFactoryFn } from "./patterns/aws/pattern.js";
@@ -288,19 +288,19 @@ export declare class App extends CdkApp {
      * same registry posture — Fjall-managed platform infrastructure,
      * deliberately NOT on the customer create/scaffold surface (design § D3).
      *
-     * Cost-allocation environment resolves from `getConfig()` (design § D10) so
-     * the fleet's environment tag matches the deploying config rather than the
-     * construct's `management` fallback; an explicit
-     * `props.costAllocationEnvironment` still wins.
-     *
-     * Alarm actions default to the account's `SharedAlarmTopicArn` export
-     * (design § D14 — alerting ships WITH the fleet): every fjall-governed
-     * account's Account/Platform stack produces that export, so alarms page
-     * out of the box. An explicit `props.alarmSnsTopicArn` still wins.
-     * `applicationId` defaults to the app name so the alarm webhook can map
-     * pages to the application; an explicit prop still wins.
+     * App-level defaults (cost-allocation environment from `getConfig()`,
+     * alarm actions to the account's `SharedAlarmTopicArn` export,
+     * `applicationId` to the app name — designs § D10/§ D14) are resolved by
+     * `resolveBuildkiteConstructProps`; explicit props always win.
+     *
+     * The props overload pins construct id `"Buildkite"` (byte-identical
+     * logical IDs for pre-factory consumers); the factory overload accepts
+     * `BuildkiteFactory.build(id, props)` — the shape the codemod add path
+     * emits. Both overloads resolve placement here, so the deploy-core
+     * fixed-stack contract cannot be bypassed from an emitted statement.
      */
     addBuildkite(props: BuildkitePropsInput): Buildkite;
+    addBuildkite(fn: BuildkiteFactoryFn): Buildkite;
     /**
      * Add a database resource to the default database stack using the factory pattern.
      * Returns the appropriate database type based on the factory used.

package/dist/lib/app.js

@@ -9,14 +9,12 @@ import { NetworkFactory } from "./patterns/aws/network.js";
 import { MessagingFactory } from "./patterns/aws/messaging.js";
 import { Schedule } from "./resources/aws/messaging/schedule.js";
 import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDiscovery.js";
-import { Buildkite } from "./patterns/aws/buildkite.js";
+import { BuildkiteFactory } from "./patterns/aws/buildkite.js";
 import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
 import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
 import { getConfig } from "./utils/getConfig.js";
-import { UNKNOWN_ENVIRONMENT } from "./utils/env.js";
-import { SHARED_ALARM_TOPIC_EXPORT_NAME } from "./config/aws/alarmTopic.js";
 import AuditRoleFactory from "./resources/aws/audit/auditRole.js";
 import { FJALL_AUDIT_CONFIG } from "./config/audit.js";
 import { FjallLogger } from "./utils/validationLogger.js";
@@ -483,46 +481,12 @@ export class App extends CdkApp {
         computeStack.addConstruct(substrate);
         return substrate;
     }
-    /**
-     * Instantiate the self-hosted Buildkite agent fleet on the default compute
-     * stack (design `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`).
-     *
-     * Same placement contract as `addDevSubstrate` above: deploy-core selects
-     * stacks by the fixed six-category enum, so scoping under
-     * `${stackPrefix}Compute` is what makes the fleet actually deploy. Also the
-     * same registry posture — Fjall-managed platform infrastructure,
-     * deliberately NOT on the customer create/scaffold surface (design § D3).
-     *
-     * Cost-allocation environment resolves from `getConfig()` (design § D10) so
-     * the fleet's environment tag matches the deploying config rather than the
-     * construct's `management` fallback; an explicit
-     * `props.costAllocationEnvironment` still wins.
-     *
-     * Alarm actions default to the account's `SharedAlarmTopicArn` export
-     * (design § D14 — alerting ships WITH the fleet): every fjall-governed
-     * account's Account/Platform stack produces that export, so alarms page
-     * out of the box. An explicit `props.alarmSnsTopicArn` still wins.
-     * `applicationId` defaults to the app name so the alarm webhook can map
-     * pages to the application; an explicit prop still wins.
-     */
-    addBuildkite(props) {
+    addBuildkite(input) {
+        const fn = typeof input === "function"
+            ? input
+            : BuildkiteFactory.build("Buildkite", input);
         const computeStack = this.getDefaultComputeStack();
-        const configEnvironment = getConfig().environment;
-        const constructProps = { ...props, vpc: this.getVpc() };
-        // Post-spread injection so a caller-materialised `costAllocationEnvironment:
-        // undefined` counts as absent rather than clobbering the resolved value.
-        if (constructProps.costAllocationEnvironment === undefined &&
-            configEnvironment !== "" &&
-            configEnvironment !== UNKNOWN_ENVIRONMENT) {
-            constructProps.costAllocationEnvironment = configEnvironment;
-        }
-        if (constructProps.alarmSnsTopicArn === undefined) {
-            constructProps.alarmSnsTopicArn = `import:${SHARED_ALARM_TOPIC_EXPORT_NAME}`;
-        }
-        if (constructProps.applicationId === undefined) {
-            constructProps.applicationId = this.getName();
-        }
-        const fleet = new Buildkite(computeStack.getStack(), "Buildkite", constructProps);
+        const fleet = fn(this, computeStack.getStack());
         computeStack.addConstruct(fleet);
         return fleet;
     }

package/dist/lib/config/aws/scpPreset.js

@@ -307,7 +307,14 @@ function buildDevIsolationGuardrails() {
                 Sid: "DenyCrossAccountAssumeRole",
                 Effect: "Deny",
                 Action: ["sts:AssumeRole", "sts:AssumeRoot"],
-                Resource: "*",
+                // NotResource carves delegation roles (the DelegationRole construct's
+                // fixed `<label>DelegateHostedZoneRole` naming contract) out of the
+                // deny — a delegated child domain deployed into a dev account must
+                // assume the parent zone's delegation role cross-account to write its
+                // NS. Those roles are NS-write-scoped by construction
+                // (delegationRole.ts). AssumeRoot stays denied everywhere: root-user
+                // ARNs never match the role pattern.
+                NotResource: "arn:aws:iam::*:role/*DelegateHostedZoneRole",
                 Condition: {
                     StringNotEquals: {
                         // IAM policy variable, substituted per-request by AWS — the

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -1,4 +1,5 @@
 import { CfnOutput, Duration, RemovalPolicy, Stack, Token } from "aws-cdk-lib";
+import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { InstanceArchitecture, InstanceType, MachineImage, SubnetType } from "aws-cdk-lib/aws-ec2";
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Source } from "aws-cdk-lib/aws-s3-deployment";
@@ -106,6 +107,12 @@ export class Buildkite extends Construct {
             userData,
             role: agentRole,
             ssmSessionPermissions: false,
+            // Upstream parity: EnableDetailedMonitoring defaults "false" in the
+            // pinned v6.68.1 template, and the wrapper's absent-default is DETAILED
+            // — omitting this silently deviated. The fleet's alarms and scaler run
+            // on Buildkite queue metrics, not EC2 metrics, so 1-minute granularity
+            // buys nothing here.
+            instanceMonitoring: Monitoring.BASIC,
             blockDevices: [
                 {
                     deviceName: "/dev/xvda",

package/dist/lib/patterns/aws/buildkite/factory.d.ts

@@ -0,0 +1,27 @@
+import { type Construct } from "constructs";
+import type App from "../../../app.js";
+import { Buildkite, type BuildkiteConstructProps } from "./buildkite.js";
+import type { BuildkitePropsInput } from "./schema.js";
+/**
+ * Thunk returned by `BuildkiteFactory.build` — materialised only by
+ * `App.addBuildkite`, which owns stack placement (the fleet has exactly one
+ * legal home, `${stackPrefix}Compute`; design
+ * `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D2).
+ */
+export type BuildkiteFactoryFn = (app: App, scope: Construct) => Buildkite;
+/**
+ * Resolve construct props from plain-data input: VPC injection plus the three
+ * app-level defaults (cost-allocation environment, shared alarm topic,
+ * applicationId). Single source for both `App.addBuildkite` entry paths
+ * (design § D2) — explicit props always win.
+ */
+export declare function resolveBuildkiteConstructProps(app: App, props: BuildkitePropsInput): BuildkiteConstructProps;
+/**
+ * Factory for the self-hosted Buildkite agent fleet — the codemod add path
+ * emits `app.addBuildkite(BuildkiteFactory.build("Buildkite", { … }))`
+ * (design § D2/§ D3). Validation, the region guard, cost tags, and pinned-AMI
+ * resolution all live in the `Buildkite` constructor and fire on every path.
+ */
+export declare class BuildkiteFactory {
+    static build(id: string, props: BuildkitePropsInput): BuildkiteFactoryFn;
+}

package/dist/lib/patterns/aws/buildkite/factory.js

@@ -0,0 +1,39 @@
+import { SHARED_ALARM_TOPIC_EXPORT_NAME } from "../../../config/aws/alarmTopic.js";
+import { UNKNOWN_ENVIRONMENT } from "../../../utils/env.js";
+import { getConfig } from "../../../utils/getConfig.js";
+import { Buildkite } from "./buildkite.js";
+/**
+ * Resolve construct props from plain-data input: VPC injection plus the three
+ * app-level defaults (cost-allocation environment, shared alarm topic,
+ * applicationId). Single source for both `App.addBuildkite` entry paths
+ * (design § D2) — explicit props always win.
+ */
+export function resolveBuildkiteConstructProps(app, props) {
+    const configEnvironment = getConfig().environment;
+    const constructProps = { ...props, vpc: app.getVpc() };
+    // Post-spread injection so a caller-materialised `costAllocationEnvironment:
+    // undefined` counts as absent rather than clobbering the resolved value.
+    if (constructProps.costAllocationEnvironment === undefined &&
+        configEnvironment !== "" &&
+        configEnvironment !== UNKNOWN_ENVIRONMENT) {
+        constructProps.costAllocationEnvironment = configEnvironment;
+    }
+    if (constructProps.alarmSnsTopicArn === undefined) {
+        constructProps.alarmSnsTopicArn = `import:${SHARED_ALARM_TOPIC_EXPORT_NAME}`;
+    }
+    if (constructProps.applicationId === undefined) {
+        constructProps.applicationId = app.getName();
+    }
+    return constructProps;
+}
+/**
+ * Factory for the self-hosted Buildkite agent fleet — the codemod add path
+ * emits `app.addBuildkite(BuildkiteFactory.build("Buildkite", { … }))`
+ * (design § D2/§ D3). Validation, the region guard, cost tags, and pinned-AMI
+ * resolution all live in the `Buildkite` constructor and fire on every path.
+ */
+export class BuildkiteFactory {
+    static build(id, props) {
+        return (app, scope) => new Buildkite(scope, id, resolveBuildkiteConstructProps(app, props));
+    }
+}

package/dist/lib/patterns/aws/buildkite/iam.js

@@ -116,6 +116,10 @@ function buildAgentPolicyDocuments(params) {
         logging: new PolicyDocument({
             statements: [
                 new PolicyStatement({
+                    // PutRetentionPolicy pairs with ENABLE_EC2_LOG_RETENTION_POLICY
+                    // ='true' in the install part (userData.ts) — the booting instance
+                    // applies agentLogRetentionDays to the /buildkite/* groups. Remove
+                    // only together with that flag.
                     actions: [
                         "logs:CreateLogGroup",
                         "logs:CreateLogStream",

package/dist/lib/patterns/aws/buildkite/schema.d.ts

@@ -1,81 +1,8 @@
-import { z } from "zod";
 /**
- * Plain-data props for the `Buildkite` pattern, validated at construct time.
- * Deliberately CDK-free so the same schema can later back the customer
- * scaffold surface if the pattern is ever promoted to `PATTERN_TYPE_VALUES`
- * (design § D3 — promotion must be additive).
- *
- * Defaults encode the design's deploy-fleet posture
- * (`aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`):
- * on-demand-only (`spotCapacityPercentage` 0 — ASG mixed-instances has no
- * spot→on-demand fallback, and a spot reclaim mid-deploy is a rollback
- * incident, § D7), scale-to-zero, whole-instance agents, bounded instance
- * staleness, and no ECR / docker-login instance-level credentials (§ D9 —
- * deploy AWS access stays server-minted; the instance profile confers none).
+ * Buildkite props schema — re-export barrel. The canonical declaration lives
+ * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
+ * validation, the codemod fragment, and the LLM JSON schema all consume one
+ * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
-export declare const BuildkitePropsSchema: z.ZodObject<{
-    buildkiteQueue: z.ZodString;
-    buildkiteOrgSlug: z.ZodString;
-    agentTokenSsmParameterName: z.ZodString;
-    agentTokenKmsKeyArn: z.ZodOptional<z.ZodString>;
-    fjallApiKeySsmParameterName: z.ZodOptional<z.ZodString>;
-    instanceType: z.ZodDefault<z.ZodString>;
-    agentVolumeSizeGib: z.ZodDefault<z.ZodNumber>;
-    agentMinInstances: z.ZodDefault<z.ZodNumber>;
-    agentMaxInstances: z.ZodDefault<z.ZodNumber>;
-    agentsPerInstance: z.ZodDefault<z.ZodNumber>;
-    spotCapacityPercentage: z.ZodDefault<z.ZodNumber>;
-    scaleInIdlePeriodSeconds: z.ZodDefault<z.ZodNumber>;
-    disconnectAfterUptimeSeconds: z.ZodDefault<z.ZodNumber>;
-    maxInstanceLifetimeDays: z.ZodDefault<z.ZodNumber>;
-    terminateInstanceAfterJob: z.ZodDefault<z.ZodBoolean>;
-    purgeBuildsOnDiskFull: z.ZodDefault<z.ZodBoolean>;
-    terminateInstanceOnDiskFull: z.ZodDefault<z.ZodBoolean>;
-    logRetentionDays: z.ZodDefault<z.ZodNumber>;
-    buildkiteAgentRelease: z.ZodDefault<z.ZodEnum<{
-        stable: "stable";
-        beta: "beta";
-        edge: "edge";
-    }>>;
-    buildkiteAgentTags: z.ZodDefault<z.ZodString>;
-    buildkiteAgentTimestampLines: z.ZodDefault<z.ZodBoolean>;
-    buildkiteAgentExperiments: z.ZodDefault<z.ZodString>;
-    buildkiteAgentTracingBackend: z.ZodDefault<z.ZodEnum<{
-        "": "";
-        datadog: "datadog";
-        opentelemetry: "opentelemetry";
-    }>>;
-    buildkiteAgentCancelGracePeriodSeconds: z.ZodDefault<z.ZodNumber>;
-    enableSecretsPlugin: z.ZodDefault<z.ZodBoolean>;
-    enableEcrPlugin: z.ZodDefault<z.ZodBoolean>;
-    enableDockerLoginPlugin: z.ZodDefault<z.ZodBoolean>;
-    enableDockerUserNamespaceRemap: z.ZodDefault<z.ZodBoolean>;
-    enableDockerExperimental: z.ZodDefault<z.ZodBoolean>;
-    dockerNetworkingProtocol: z.ZodDefault<z.ZodEnum<{
-        ipv4: "ipv4";
-        dualstack: "dualstack";
-    }>>;
-    enableInstanceStorage: z.ZodDefault<z.ZodBoolean>;
-    mountTmpfsAtTmp: z.ZodDefault<z.ZodBoolean>;
-    buildkiteAgentEnableGitMirrors: z.ZodDefault<z.ZodBoolean>;
-    bootstrapScriptUrl: z.ZodDefault<z.ZodString>;
-    agentEnvFileUrl: z.ZodDefault<z.ZodString>;
-    scalerEventSchedulePeriod: z.ZodDefault<z.ZodString>;
-    scalerMinPollInterval: z.ZodDefault<z.ZodString>;
-    scaleOutFactor: z.ZodDefault<z.ZodString>;
-    scaleOutWaitingForJobs: z.ZodDefault<z.ZodBoolean>;
-    rolePermissionsBoundaryArn: z.ZodOptional<z.ZodString>;
-    alarmSnsTopicArn: z.ZodOptional<z.ZodString>;
-    applicationId: z.ZodOptional<z.ZodString>;
-    costAllocationEnvironment: z.ZodOptional<z.ZodString>;
-    costAllocationOwner: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export type BuildkiteProps = z.infer<typeof BuildkitePropsSchema>;
-/** Caller-facing shape: fields with defaults are optional at the call site. */
-export type BuildkitePropsInput = z.input<typeof BuildkitePropsSchema>;
-/**
- * Validate + default the plain-data props at construct time. Throws a
- * synth-time error listing every violation — the pattern's constructor is the
- * validation boundary, mirroring `ClickHouseDatabase`'s Stage-1 shape.
- */
-export declare function validateBuildkiteProps(props: BuildkitePropsInput): BuildkiteProps;
+export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps, type BuildkiteProps, type BuildkitePropsInput, type BuildkitePropsObject } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/schema.js

@@ -1,155 +1,8 @@
-import { z } from "zod";
 /**
- * Plain-data props for the `Buildkite` pattern, validated at construct time.
- * Deliberately CDK-free so the same schema can later back the customer
- * scaffold surface if the pattern is ever promoted to `PATTERN_TYPE_VALUES`
- * (design § D3 — promotion must be additive).
- *
- * Defaults encode the design's deploy-fleet posture
- * (`aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`):
- * on-demand-only (`spotCapacityPercentage` 0 — ASG mixed-instances has no
- * spot→on-demand fallback, and a spot reclaim mid-deploy is a rollback
- * incident, § D7), scale-to-zero, whole-instance agents, bounded instance
- * staleness, and no ECR / docker-login instance-level credentials (§ D9 —
- * deploy AWS access stays server-minted; the instance profile confers none).
+ * Buildkite props schema — re-export barrel. The canonical declaration lives
+ * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
+ * validation, the codemod fragment, and the LLM JSON schema all consume one
+ * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
-export const BuildkitePropsSchema = z
-    .object({
-    /** Buildkite queue this fleet serves (cluster-scoped via the token). */
-    buildkiteQueue: z
-        .string()
-        .min(1, "buildkiteQueue cannot be empty")
-        .max(100)
-        .regex(/^[a-zA-Z0-9-_]+$/, "buildkiteQueue must be alphanumeric with hyphens/underscores"),
-    /**
-     * Buildkite organisation slug (e.g. `fjall-tech`). The
-     * buildkite-agent-scaler publishes its CloudWatch metrics dimensioned by
-     * {Org, Queue} — the fleet's alarms must query the same pair or they read
-     * no data at all (heartbeat permanently ALARM, queued-with-zero-capacity
-     * permanently inert).
-     */
-    buildkiteOrgSlug: z
-        .string()
-        .min(1, "buildkiteOrgSlug cannot be empty")
-        .max(100)
-        .regex(/^[a-z0-9-]+$/, "buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),
-    /**
-     * Name of the pre-provisioned SSM SecureString holding the cluster-scoped
-     * agent token (e.g. `/Buildkite/agents/agent-token`). Provisioned
-     * out-of-band via `fjall secrets` tooling — the construct receives the
-     * identifier only; no secret value ever transits synth (design § D4).
-     */
-    agentTokenSsmParameterName: z
-        .string()
-        .min(2)
-        .regex(/^\//, "agentTokenSsmParameterName must be a full path (leading /)"),
-    /**
-     * KMS key ARN encrypting the agent-token parameter, when a customer
-     * managed key is used. Omit for the AWS-managed `aws/ssm` key.
-     */
-    agentTokenKmsKeyArn: z.string().min(1).optional(),
-    /**
-     * Name of the SSM SecureString holding FJALL_API_KEY. When set, the
-     * construct ships a per-job `env` hook into the managed secrets bucket
-     * that reads the parameter at job start (rotation takes effect on the
-     * next job, no instance replacement — design § D4(iii)) and grants the
-     * instance profile read on exactly this parameter.
-     */
-    fjallApiKeySsmParameterName: z
-        .string()
-        .min(2)
-        .regex(/^\//, "fjallApiKeySsmParameterName must be a full path (leading /)")
-        .optional(),
-    /** EC2 instance type. Graviton default per design § D7. */
-    instanceType: z.string().min(1).default("c8g.xlarge"),
-    agentVolumeSizeGib: z.number().int().min(20).max(1000).default(250),
-    agentMinInstances: z.number().int().min(0).default(0),
-    agentMaxInstances: z.number().int().min(1).default(2),
-    agentsPerInstance: z.number().int().min(1).default(1),
-    /**
-     * Percentage of capacity on spot. Deploy fleets MUST stay 0 (on-demand
-     * only): no spot→on-demand fallback mechanism exists, and a reclaim
-     * mid-deploy lands in the rollback-wedge class (design § D7). Non-zero is
-     * for Phase-2 CI fleets running idempotent, auto-retried jobs.
-     */
-    spotCapacityPercentage: z.number().int().min(0).max(100).default(0),
-    /** Agent-driven scale-in: idle seconds before an instance self-terminates. */
-    scaleInIdlePeriodSeconds: z.number().int().min(60).default(600),
-    /** Bounded instance staleness; also caps stale-token propagation (§ D5). */
-    disconnectAfterUptimeSeconds: z.number().int().min(3600).default(86_400),
-    maxInstanceLifetimeDays: z.number().int().min(1).max(365).default(7),
-    terminateInstanceAfterJob: z.boolean().default(false),
-    purgeBuildsOnDiskFull: z.boolean().default(true),
-    terminateInstanceOnDiskFull: z.boolean().default(false),
-    /** CloudWatch retention for the scaler's log group (days). */
-    logRetentionDays: z.number().int().min(1).default(30),
-    buildkiteAgentRelease: z.enum(["stable", "beta", "edge"]).default("stable"),
-    buildkiteAgentTags: z.string().default(""),
-    buildkiteAgentTimestampLines: z.boolean().default(false),
-    buildkiteAgentExperiments: z.string().default(""),
-    buildkiteAgentTracingBackend: z
-        .enum(["", "datadog", "opentelemetry"])
-        .default(""),
-    buildkiteAgentCancelGracePeriodSeconds: z
-        .number()
-        .int()
-        .min(10)
-        .default(60),
-    /** S3 secrets-hooks plugin — required for the FJALL_API_KEY env hook. */
-    enableSecretsPlugin: z.boolean().default(true),
-    /**
-     * ECR + docker-login plugins default OFF: the instance profile carries no
-     * registry credentials (design § D9); deploy jobs authenticate through
-     * server-minted credentials exactly as on hosted agents.
-     */
-    enableEcrPlugin: z.boolean().default(false),
-    enableDockerLoginPlugin: z.boolean().default(false),
-    enableDockerUserNamespaceRemap: z.boolean().default(true),
-    enableDockerExperimental: z.boolean().default(false),
-    dockerNetworkingProtocol: z.enum(["ipv4", "dualstack"]).default("ipv4"),
-    enableInstanceStorage: z.boolean().default(false),
-    mountTmpfsAtTmp: z.boolean().default(true),
-    buildkiteAgentEnableGitMirrors: z.boolean().default(false),
-    bootstrapScriptUrl: z.string().default(""),
-    agentEnvFileUrl: z.string().default(""),
-    scalerEventSchedulePeriod: z.string().min(1).default("1 minute"),
-    scalerMinPollInterval: z.string().min(1).default("10s"),
-    scaleOutFactor: z.string().min(1).default("1.0"),
-    scaleOutWaitingForJobs: z.boolean().default(false),
-    /** IAM permissions boundary for the scaler's roles; emitted only when set. */
-    rolePermissionsBoundaryArn: z.string().min(1).optional(),
-    /**
-     * SNS topic receiving the fleet's two alarms (scaler heartbeat + queued
-     * with zero capacity — design § D14). Omit to create the alarms without
-     * actions (visible on the console, silent).
-     */
-    alarmSnsTopicArn: z.string().min(1).optional(),
-    /**
-     * Fjall application the fleet belongs to — appended to alarm
-     * descriptions and tagged (`fjall:applicationId`) so the alarm webhook
-     * can map pages to the application. `App.addBuildkite` injects the app
-     * name automatically; set only to override.
-     */
-    applicationId: z.string().min(1).optional(),
-    costAllocationEnvironment: z.string().min(1).optional(),
-    costAllocationOwner: z.string().min(1).optional()
-})
-    .strict()
-    .refine((props) => props.agentMinInstances <= props.agentMaxInstances, {
-    message: "agentMinInstances must be <= agentMaxInstances"
-});
-/**
- * Validate + default the plain-data props at construct time. Throws a
- * synth-time error listing every violation — the pattern's constructor is the
- * validation boundary, mirroring `ClickHouseDatabase`'s Stage-1 shape.
- */
-export function validateBuildkiteProps(props) {
-    const result = BuildkitePropsSchema.safeParse(props);
-    if (!result.success) {
-        const details = result.error.issues
-            .map((issue) => `  - ${issue.path.join(".") || "(root)"}: ${issue.message}`)
-            .join("\n");
-        throw new Error(`Buildkite: invalid props:\n${details}`);
-    }
-    return result.data;
-}
+export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/userData.d.ts

@@ -42,7 +42,7 @@ export declare function buildBuildkiteDockerCommands(props: BuildkiteProps): str
  * `bk-install-elastic-stack.sh`, mirroring the upstream block key-for-key in
  * upstream order (so a fixture-bump diff reads line-by-line). Keys with no
  * schema knob carry the upstream v6.68.1 parameter default verbatim, with
- * three deliberate deviations:
+ * four deliberate deviations:
  *
  * - `BUILDKITE_S3_ACL`: our artifact bucket is BucketOwnerEnforced (ACLs
  *   disabled), where S3 rejects every canned ACL EXCEPT
@@ -54,5 +54,16 @@ export declare function buildBuildkiteDockerCommands(props: BuildkiteProps): str
  *   is out of scope for the Phase-1 deploy fleet; a future signing knob must
  *   land WITH the kms:Sign/Verify/GetPublicKey grants it needs (the prior
  *   knob shipped without them — a dead toggle that broke agents when set).
+ * - `ENABLE_EC2_LOG_RETENTION_POLICY`: hard-pinned `true` (upstream default
+ *   `false`, "preserve all logs"). Fjall's log-group lifecycle posture is
+ *   bounded retention everywhere: each booting instance applies
+ *   `agentLogRetentionDays` to the agent-created `/buildkite/*` groups via
+ *   the instance role's `logs:PutRetentionPolicy` grant (which this flag
+ *   makes live — it was stranded while `false`). Retro-applies to existing
+ *   groups on the next boot after enabling, expiring events older than the
+ *   window. Residual: runtime-created groups stay untagged — the namespace
+ *   is account-global (shared across fleets and stacks), so CFN pre-creation
+ *   would fight cross-stack ownership; cost exposure is bounded by the
+ *   retention itself.
  */
 export declare function buildBuildkiteInstallCommands(props: BuildkiteProps, context: BuildkiteUserDataContext): string[];

package/dist/lib/patterns/aws/buildkite/userData.js

@@ -149,7 +149,7 @@ export function buildBuildkiteDockerCommands(props) {
  * `bk-install-elastic-stack.sh`, mirroring the upstream block key-for-key in
  * upstream order (so a fixture-bump diff reads line-by-line). Keys with no
  * schema knob carry the upstream v6.68.1 parameter default verbatim, with
- * three deliberate deviations:
+ * four deliberate deviations:
  *
  * - `BUILDKITE_S3_ACL`: our artifact bucket is BucketOwnerEnforced (ACLs
  *   disabled), where S3 rejects every canned ACL EXCEPT
@@ -161,6 +161,17 @@ export function buildBuildkiteDockerCommands(props) {
  *   is out of scope for the Phase-1 deploy fleet; a future signing knob must
  *   land WITH the kms:Sign/Verify/GetPublicKey grants it needs (the prior
  *   knob shipped without them — a dead toggle that broke agents when set).
+ * - `ENABLE_EC2_LOG_RETENTION_POLICY`: hard-pinned `true` (upstream default
+ *   `false`, "preserve all logs"). Fjall's log-group lifecycle posture is
+ *   bounded retention everywhere: each booting instance applies
+ *   `agentLogRetentionDays` to the agent-created `/buildkite/*` groups via
+ *   the instance role's `logs:PutRetentionPolicy` grant (which this flag
+ *   makes live — it was stranded while `false`). Retro-applies to existing
+ *   groups on the next boot after enabling, expiring events older than the
+ *   window. Residual: runtime-created groups stay untagged — the namespace
+ *   is account-global (shared across fleets and stacks), so CFN pre-creation
+ *   would fight cross-stack ownership; cost exposure is bounded by the
+ *   retention itself.
  */
 export function buildBuildkiteInstallCommands(props, context) {
     return [
@@ -219,8 +230,8 @@ export function buildBuildkiteInstallCommands(props, context) {
         "RESOURCE_LIMITS_CPU_WEIGHT='100' \\",
         "RESOURCE_LIMITS_CPU_QUOTA='90%' \\",
         "RESOURCE_LIMITS_IO_WEIGHT='80' \\",
-        "ENABLE_EC2_LOG_RETENTION_POLICY='false' \\",
-        "EC2_LOG_RETENTION_DAYS='7' \\",
+        "ENABLE_EC2_LOG_RETENTION_POLICY='true' \\",
+        `EC2_LOG_RETENTION_DAYS='${props.agentLogRetentionDays}' \\`,
         "/usr/local/bin/bk-install-elastic-stack.sh"
     ];
 }

package/dist/lib/patterns/aws/buildkite.d.ts

@@ -7,5 +7,6 @@
 export { Buildkite, FJALL_ENV_HOOK_OBJECT_KEY, buildFjallApiKeyEnvHookScript, type BuildkiteConstructProps } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn, type BuildkiteCpuArchitecture } from "./buildkite/pins.js";
 export { BuildkitePropsSchema, validateBuildkiteProps, type BuildkiteProps, type BuildkitePropsInput } from "./buildkite/schema.js";
+export { BuildkiteFactory, type BuildkiteFactoryFn } from "./buildkite/factory.js";
 export { BUILDKITE_AGENT_IAM_ACTION_ALLOWLIST, buildAgentRole, type BuildkiteAgentRoleParams } from "./buildkite/iam.js";
 export { BUILDKITE_DOCKER_PART_ENV_KEYS, BUILDKITE_MOUNT_PART_ENV_KEYS, BUILDKITE_USER_DATA_ENV_KEYS, buildBuildkiteDockerCommands, buildBuildkiteInstallCommands, buildBuildkiteMountCommands, buildBuildkiteUserData, type BuildkiteUserDataContext } from "./buildkite/userData.js";

package/dist/lib/patterns/aws/buildkite.js

@@ -7,5 +7,6 @@
 export { Buildkite, FJALL_ENV_HOOK_OBJECT_KEY, buildFjallApiKeyEnvHookScript } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn } from "./buildkite/pins.js";
 export { BuildkitePropsSchema, validateBuildkiteProps } from "./buildkite/schema.js";
+export { BuildkiteFactory } from "./buildkite/factory.js";
 export { BUILDKITE_AGENT_IAM_ACTION_ALLOWLIST, buildAgentRole } from "./buildkite/iam.js";
 export { BUILDKITE_DOCKER_PART_ENV_KEYS, BUILDKITE_MOUNT_PART_ENV_KEYS, BUILDKITE_USER_DATA_ENV_KEYS, buildBuildkiteDockerCommands, buildBuildkiteInstallCommands, buildBuildkiteMountCommands, buildBuildkiteUserData } from "./buildkite/userData.js";

package/dist/lib/resources/aws/compute/ecsServiceFactory.d.ts

@@ -1,9 +1,9 @@
 import { FargateService, Ec2Service, AsgCapacityProvider, type DeploymentCircuitBreaker } from "aws-cdk-lib/aws-ecs";
 import type { FargateTaskDefinition, Ec2TaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
-import { TargetTrackingScalingPolicy, type StepScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
+import { TargetTrackingScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
 import { type AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
-import { type EcsServiceProps, type Ec2CapacityConfig } from "./ecsTypes.js";
+import { type EcsServiceProps, type Ec2CapacityConfig, type QueueScalingResources } from "./ecsTypes.js";
 import type { EcsConstructContext } from "./ecsContext.js";
 /**
  * Resolves the user's `circuitBreaker` config to the CDK
@@ -41,4 +41,4 @@ export declare function createService(ctx: EcsConstructContext, serviceName: str
  * policy on utilisation; `QUEUE` emits a step-scaling policy on SQS backlog
  * that can wake the service from `desiredCount: 0`.
  */
-export declare function addServiceScaling(ctx: EcsConstructContext, serviceName: string, serviceProps: EcsServiceProps, service: FargateService | Ec2Service): TargetTrackingScalingPolicy | StepScalingPolicy;
+export declare function addServiceScaling(ctx: EcsConstructContext, serviceName: string, serviceProps: EcsServiceProps, service: FargateService | Ec2Service): TargetTrackingScalingPolicy | QueueScalingResources;

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -3,8 +3,9 @@ import { Peer, Port, SubnetType, UserData } from "aws-cdk-lib/aws-ec2";
 import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { Role } from "../iam/role.js";
 import { CfnOutput, Duration, Token } from "aws-cdk-lib";
-import { AdjustmentType, PredefinedMetric, ScalableTarget, ServiceNamespace, TargetTrackingScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
-import { MathExpression } from "aws-cdk-lib/aws-cloudwatch";
+import { AdjustmentType, PredefinedMetric, ScalableTarget, ServiceNamespace, StepScalingAction, TargetTrackingScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
+import { Alarm, ComparisonOperator, MathExpression } from "aws-cdk-lib/aws-cloudwatch";
+import { ApplicationScalingAction } from "aws-cdk-lib/aws-cloudwatch-actions";
 import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { Ec2Instance } from "./ec2.js";
@@ -283,13 +284,14 @@ export function createService(ctx, serviceName, serviceProps, taskDefinition, as
     return service;
 }
 /**
- * Step-scaling intervals on the queue-backlog metric, with
- * `AdjustmentType.EXACT_CAPACITY` (`change` is the absolute DesiredCount).
- * Backlog 0 → 0 tasks (wake-to-zero); ≥1 → 1; ≥100 → 2; ≥500 → 3. Capacities
- * are clamped to the service's `maxCapacity` at build time.
+ * Wake-ladder intervals on the queue-backlog metric, with
+ * `AdjustmentType.EXACT_CAPACITY` (`capacity` is the absolute DesiredCount).
+ * Backlog ≥1 → 1 task; ≥100 → 2; ≥500 → 3. Capacities are clamped to the
+ * service's `maxCapacity` at build time. Bounds are absolute backlog values;
+ * `buildQueueScalingPolicy` re-expresses them relative to the wake alarm's
+ * threshold (the first interval's `lower`).
  */
-const DEFAULT_QUEUE_SCALING_STEPS = [
-    { lower: 0, upper: 1, capacity: 0 },
+const QUEUE_WAKE_SCALING_STEPS = [
     { lower: 1, upper: 100, capacity: 1 },
     { lower: 100, upper: 500, capacity: 2 },
     { lower: 500, capacity: 3 }
@@ -327,11 +329,21 @@ export function addServiceScaling(ctx, serviceName, serviceProps, service) {
     });
 }
 /**
- * Builds the step-scaling policy for `ScalingType.QUEUE`. The alarm metric is a
- * `MathExpression` SUM of `ApproximateNumberOfMessagesVisible`
+ * Builds the wake/sleep step-scaling pair for `ScalingType.QUEUE`. The alarm
+ * metric is a `MathExpression` SUM of `ApproximateNumberOfMessagesVisible`
  * (+`…NotVisible` when `includeInFlight`) across the consumed queues, sampled at
  * `Maximum` over 1-minute periods — published independent of running-task count,
- * so the policy fires (and DesiredCount rises from 0) on backlog alone.
+ * so the alarms fire (and DesiredCount rises from 0) on backlog alone.
+ *
+ * The actions and alarms are wired explicitly rather than via
+ * `ScalableTarget.scaleOnMetric`: CDK's `StepScalingPolicy` middle-splits an
+ * all-`EXACT_CAPACITY` interval ladder to place its two alarm thresholds
+ * (`findAlarmThresholds` in aws-autoscaling-common), which for a
+ * 0/1/100/500 ladder puts BOTH thresholds at 100. Step policies are only
+ * invoked on alarm state transitions, so backlog 1–99 produced no transition
+ * and could never wake a zero-task service. The explicit pair pins the wake
+ * threshold at the ladder's first bound (backlog ≥ 1) and the sleep threshold
+ * at 0, making every 0↔1 backlog crossing a state transition.
  */
 function buildQueueScalingPolicy(serviceName, config, scalableTarget, maxCapacity) {
     if (config === undefined || config.queues.length === 0) {
@@ -363,16 +375,46 @@ function buildQueueScalingPolicy(serviceName, config, scalableTarget, maxCapacit
         period: Duration.minutes(1),
         label: `${serviceName}QueueBacklog`
     });
-    return scalableTarget.scaleOnMetric(`${serviceName}QueueScaling`, {
+    const cooldown = config.cooldown ?? DEFAULT_QUEUE_SCALE_COOLDOWN;
+    const wakeThreshold = QUEUE_WAKE_SCALING_STEPS[0]?.lower ?? 1;
+    const wakeAction = new StepScalingAction(scalableTarget, `${serviceName}QueueWakeAction`, {
+        scalingTarget: scalableTarget,
+        adjustmentType: AdjustmentType.EXACT_CAPACITY,
+        cooldown
+    });
+    QUEUE_WAKE_SCALING_STEPS.forEach((step, index) => {
+        wakeAction.addAdjustment({
+            adjustment: Math.min(step.capacity, maxCapacity),
+            lowerBound: step.lower - wakeThreshold,
+            ...(index < QUEUE_WAKE_SCALING_STEPS.length - 1 &&
+                step.upper !== undefined && { upperBound: step.upper - wakeThreshold })
+        });
+    });
+    const wakeAlarm = new Alarm(scalableTarget, `${serviceName}QueueWakeAlarm`, {
         metric: backlogMetric,
+        alarmDescription: `Scale out '${serviceName}' on queue backlog`,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: wakeThreshold,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1
+    });
+    wakeAlarm.addAlarmAction(new ApplicationScalingAction(wakeAction));
+    const sleepAction = new StepScalingAction(scalableTarget, `${serviceName}QueueSleepAction`, {
+        scalingTarget: scalableTarget,
         adjustmentType: AdjustmentType.EXACT_CAPACITY,
-        scalingSteps: DEFAULT_QUEUE_SCALING_STEPS.map((step) => ({
-            lower: step.lower,
-            ...(step.upper !== undefined && { upper: step.upper }),
-            change: Math.min(step.capacity, maxCapacity)
-        })),
-        cooldown: config.cooldown ?? DEFAULT_QUEUE_SCALE_COOLDOWN,
+        cooldown
+    });
+    // upperBound is relative to the alarm threshold (0), so this single
+    // open-ended interval covers exactly backlog ≤ 0.
+    sleepAction.addAdjustment({ adjustment: 0, upperBound: 0 });
+    const sleepAlarm = new Alarm(scalableTarget, `${serviceName}QueueSleepAlarm`, {
+        metric: backlogMetric,
+        alarmDescription: `Scale '${serviceName}' to zero on empty queue`,
+        comparisonOperator: ComparisonOperator.LESS_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 0,
         evaluationPeriods: 1,
         datapointsToAlarm: 1
     });
+    sleepAlarm.addAlarmAction(new ApplicationScalingAction(sleepAction));
+    return { wakeAction, wakeAlarm, sleepAction, sleepAlarm };
 }

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -4,7 +4,8 @@ import { type Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { type IService } from "aws-cdk-lib/aws-servicediscovery";
 import { type IManagedPolicy, type PolicyDocument } from "aws-cdk-lib/aws-iam";
 import type { DockerBuild } from "@fjall/util/manifest/schemas";
-import { type TargetTrackingScalingPolicy, type StepScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
+import { type TargetTrackingScalingPolicy, type StepScalingAction } from "aws-cdk-lib/aws-applicationautoscaling";
+import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type Duration } from "aws-cdk-lib";
 import { type GeoLocation } from "aws-cdk-lib/aws-route53";
@@ -63,6 +64,29 @@ export interface QueueScalingConfig {
     /** Cooldown after a scale action. Default: 5 minutes. */
     cooldown?: Duration;
 }
+/**
+ * The explicitly-wired wake/sleep alarm pair emitted for `ScalingType.QUEUE`.
+ *
+ * Built by hand (NOT via `ScalableTarget.scaleOnMetric`) because CDK's
+ * `StepScalingPolicy` places its two alarm thresholds by middle-splitting the
+ * interval ladder when every `EXACT_CAPACITY` step carries a change — for the
+ * default 4-step ladder that puts BOTH thresholds at backlog 100, and since
+ * step policies are only invoked on alarm state transitions, a backlog of
+ * 1–99 can never wake a `desiredCount: 0` service (observed live: the prod
+ * deploy-worker sat at 0 tasks with 1 queued message indefinitely). The
+ * explicit pair pins the wake boundary at backlog ≥ 1 and the sleep boundary
+ * at backlog 0.
+ */
+export interface QueueScalingResources {
+    /** Scale-out action: backlog ≥ 1 → capacity ladder (1/2/3, clamped). */
+    wakeAction: StepScalingAction;
+    /** Alarm at backlog ≥ 1 driving `wakeAction`. */
+    wakeAlarm: Alarm;
+    /** Scale-in action: backlog 0 → capacity 0. */
+    sleepAction: StepScalingAction;
+    /** Alarm at backlog ≤ 0 driving `sleepAction`. */
+    sleepAlarm: Alarm;
+}
 import type { EcsCapacityProvider } from "@fjall/generator";
 export type { EcsCapacityProvider };
 /**
@@ -607,7 +631,7 @@ export interface ServiceData {
     containers: ContainerDefinition[];
     primaryContainer?: ContainerDefinition;
     targetGroup?: IApplicationTargetGroup;
-    scalingPolicy?: TargetTrackingScalingPolicy | StepScalingPolicy;
+    scalingPolicy?: TargetTrackingScalingPolicy | QueueScalingResources;
     /** Explicit log group shared by all of the service's containers. */
     logGroup: ILogGroup;
 }

package/dist/lib/resources/aws/networking/domainCertificate.js

@@ -1,6 +1,7 @@
 import { CfnOutput, Tags } from "aws-cdk-lib";
 import { Certificate, CertificateValidation } from "aws-cdk-lib/aws-certificatemanager";
 import { getDomainExportNames } from "@fjall/util";
+import { sanitiseAcmTagValue } from "../../../utils/acmTagValue.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
 /**
@@ -33,10 +34,12 @@ export class DomainCertificate extends Certificate {
         this.description =
             props.description ??
                 `Fjall-managed ACM certificate for ${props.domainName}`;
-        Tags.of(this).add("fjall:description", this.description);
+        // ACM's tag-value charset excludes `*`, so a wildcard domainName in either
+        // tag fails CreateCertificate — sanitise both (see utils/acmTagValue.ts).
+        Tags.of(this).add("fjall:description", sanitiseAcmTagValue(this.description));
         applyCostAllocationTags(this, {
             service: "certificate",
-            domain: props.costAllocationDomain ?? props.domainName,
+            domain: sanitiseAcmTagValue(props.costAllocationDomain ?? props.domainName),
             environment: props.costAllocationEnvironment,
             inheritEnvironment: props.inheritCostAllocationEnvironment
         });

package/dist/lib/utils/acmTagValue.d.ts

@@ -0,0 +1,2 @@
+/** Replace every ACM-disallowed character with `_` (an allowed character). */
+export declare function sanitiseAcmTagValue(value: string): string;

package/dist/lib/utils/acmTagValue.js

@@ -0,0 +1,13 @@
+/**
+ * ACM rejects tag values containing characters outside
+ * `[\p{L}\p{Z}\p{N}_.:/=+\-@]*` (letters, spaces, numbers, `_ . : / = + - @`)
+ * with a CreateCertificate ValidationException — notably `*`, so any tag
+ * embedding a wildcard domain (`*.dev.example.com`) fails the whole stack at
+ * deploy time. Most other taggable services (S3, EC2, Route53) accept `*`,
+ * which is why the constraint only surfaces at the certificate boundary.
+ */
+const ACM_TAG_VALUE_DISALLOWED = /[^\p{L}\p{Z}\p{N}_.:/=+\-@]/gu;
+/** Replace every ACM-disallowed character with `_` (an allowed character). */
+export function sanitiseAcmTagValue(value) {
+    return value.replace(ACM_TAG_VALUE_DISALLOWED, "_");
+}

package/dist/lib/utils/costAllocationTags.d.ts

@@ -1,11 +1,6 @@
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "@fjall/util/aws";
 import type { IConstruct } from "constructs";
-export declare const COST_ALLOCATION_TAGS: {
-    readonly ENVIRONMENT: "fjall:costAllocation:environment";
-    readonly SERVICE: "fjall:costAllocation:service";
-    readonly DOMAIN: "fjall:costAllocation:domain";
-    readonly OWNER: "fjall:costAllocation:owner";
-};
-export declare const DEFAULT_COST_ALLOCATION_ENVIRONMENT: "management";
+export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
 export interface CostAllocationTagsArgs {
     readonly service: string;
     readonly domain: string;

package/dist/lib/utils/costAllocationTags.js

@@ -1,11 +1,9 @@
+import { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT } from "@fjall/util/aws";
 import { Tags } from "aws-cdk-lib";
-export const COST_ALLOCATION_TAGS = {
-    ENVIRONMENT: "fjall:costAllocation:environment",
-    SERVICE: "fjall:costAllocation:service",
-    DOMAIN: "fjall:costAllocation:domain",
-    OWNER: "fjall:costAllocation:owner"
-};
-export const DEFAULT_COST_ALLOCATION_ENVIRONMENT = "management";
+// Canonical home: @fjall/util (`util/src/aws/costAllocationTags.ts`) — shared
+// with deploy-core's `cdk bootstrap --tags` stamping. Re-exported here so
+// construct-package consumers keep their existing import path.
+export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT };
 export function applyCostAllocationTags(scope, args) {
     if (args.environment !== undefined) {
         Tags.of(scope).add(COST_ALLOCATION_TAGS.ENVIRONMENT, args.environment);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.2.1",
+  "version": "3.4.1",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.2.1",
-    "@fjall/util": "^3.2.1",
+    "@fjall/generator": "^3.4.1",
+    "@fjall/util": "^3.4.1",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "1a249298df7bf3104d9d49b47700234db815ebb1"
+  "gitHead": "6d8ef9582d5abe6a8199431815dae761887c18d4"
 }