@fjall/components-infrastructure 3.4.1 → 3.6.0

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -16,15 +16,18 @@ export const RDS_DEFAULTS = Object.freeze({
  * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
  * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
  * is the only mode under which min-0 actually saves (a live pooled connection
- * pins the cluster above 0 ACU). Engine 16.6 satisfies the auto-pause-capable
- * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`).
+ * pins the cluster above 0 ACU). Engine 16.10 satisfies the auto-pause-capable
+ * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`). AWS removes old minors from
+ * the creatable list over time (16.6 rejected with "Cannot find version" by
+ * 2026-07) — pin a mid-window minor, not the oldest available, and expect this
+ * to need a bump roughly yearly.
  */
 export const DEV_AURORA_DEFAULTS = Object.freeze({
     SERVERLESS_V2_MIN_CAPACITY: 0,
     SERVERLESS_V2_MAX_CAPACITY: 4,
     AUTO_PAUSE_SECONDS: 1200,
     ENABLE_DATA_API: true,
-    ENGINE_VERSION: "16.6"
+    ENGINE_VERSION: "16.10"
 });
 /**
  * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`

package/dist/lib/resources/aws/networking/crossAccountDelegationRecord.d.ts

@@ -6,6 +6,16 @@ export interface CrossAccountDelegationRecordProps {
     readonly delegatedZone: IHostedZone;
     readonly delegatedZoneName: string;
     readonly parentHostedZoneName: string;
+    /**
+     * Literal NS hostnames for an ADOPTED (imported) delegated zone. An
+     * imported `IHostedZone` exposes no `hostedZoneNameServers` attribute —
+     * CDK cannot know a live zone's NS at synth — so the custom resource
+     * would UPSERT an empty parent NS row. When set, a facade over the
+     * imported zone supplies these literals instead (see
+     * `withLiteralNameServers`). Omit for created zones, whose NS arrive as
+     * a CloudFormation attribute token.
+     */
+    readonly adoptedNameServers?: string[];
     readonly description?: string;
     readonly costAllocationEnvironment?: string;
     readonly costAllocationDomain?: string;

package/dist/lib/resources/aws/networking/crossAccountDelegationRecord.js

@@ -2,6 +2,29 @@ import { Construct } from "constructs";
 import { Tags } from "aws-cdk-lib";
 import { CrossAccountZoneDelegationRecord as CdkCrossAccountZoneDelegationRecord } from "aws-cdk-lib/aws-route53";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
+/**
+ * CDK facade seam for zone adoption. `CrossAccountZoneDelegationRecord`
+ * reads exactly `zoneName` and `hostedZoneNameServers` off its
+ * `delegatedZone`; the facade delegates every access to the imported zone
+ * and overrides only `hostedZoneNameServers` with the user-declared
+ * literals. Methods are bound to the underlying zone so `this`-dependent
+ * internals behave identically. Pinned by the adopted-case synth snapshot
+ * in crossAccountDelegationRecord.test.ts — a CDK upgrade that starts
+ * reading more through this seam trips the pin.
+ */
+function withLiteralNameServers(zone, nameServers) {
+    return new Proxy(zone, {
+        get(target, property) {
+            if (property === "hostedZoneNameServers") {
+                return [...nameServers];
+            }
+            const value = Reflect.get(target, property);
+            return typeof value === "function"
+                ? value.bind(target)
+                : value;
+        }
+    });
+}
 // CDK's CrossAccountZoneDelegationRecord is a custom-resource Lambda: user-level tags
 // on the record itself may not reach AWS. We tag the wrapping Fjall Construct for
 // assertion purposes; create-path tags still propagate to child resources (Lambda,
@@ -14,9 +37,12 @@ export class CrossAccountDelegationRecord extends Construct {
         this.description =
             props.description ??
                 `Fjall-managed cross-account delegation for ${props.delegatedZoneName} in parent ${props.parentHostedZoneName}`;
+        const delegatedZone = props.adoptedNameServers !== undefined
+            ? withLiteralNameServers(props.delegatedZone, props.adoptedNameServers)
+            : props.delegatedZone;
         this.record = new CdkCrossAccountZoneDelegationRecord(this, "Record", {
             delegationRole: props.delegationRole,
-            delegatedZone: props.delegatedZone,
+            delegatedZone,
             parentHostedZoneName: props.parentHostedZoneName
         });
         Tags.of(this).add("fjall:description", this.description);

package/dist/lib/resources/aws/secrets/secret.d.ts

@@ -17,6 +17,12 @@ interface SecretProps {
      */
     secretStringValue?: string;
     description?: string;
+    /**
+     * KMS alias for the wrapper-minted encryption CMK. Aliases are unique per
+     * account+region, so callers whose construct id is not account-unique (e.g.
+     * a fixed-name pattern deployed once per app) MUST pass an app-scoped alias.
+     * @default cmk/<construct id>
+     */
     aliasName?: string;
     generateSecretString?: SecretStringGenerator;
     /** Regions where this secret should be replicated (for Global Aurora) */

package/dist/lib/resources/aws/secrets/secret.js

@@ -71,7 +71,7 @@ export class Secret extends Construct {
         }
         // Create KMS key for new secrets only
         const customerManagedKey = new CustomerManagedKey(this, `${id}CustomerManagedKey`, {
-            aliasName: `cmk/${id}`
+            aliasName: props.aliasName ?? `cmk/${id}`
         });
         this.secretsCustomerManagedKey = customerManagedKey;
         /**

package/dist/lib/utils/domainTypes.d.ts

@@ -29,15 +29,9 @@ export declare function resolveRecordFqdn(recordName: string, zoneName: string):
 /**
  * Two-step deploy phase for constructs whose certificates must not be issued
  * before their zone's NS delegation has propagated (design R2 cert-hang
- * guard). `"zone"` synthesises the hosted zone (+ delegation record) only;
- * `"full"` additionally issues certificates. Shared by the delegated `Domain`
- * topology and `DevSubstrate` — lowest common layer per generator-standards
- * § Infrastructure Layer Boundaries.
+ * guard) plus its omitted-phase default — homed in `@fjall/util`
+ * (`infra/domainExports.ts`, the lowest common layer) and re-exported here
+ * so construct-side consumers keep their import path. deploy-core's
+ * `orchestration/domain/types.ts` re-exports the same declaration.
  */
-export type DomainDeployPhase = "zone" | "full";
-/**
- * Default deploy phase when `phase` is omitted — the complete build. The
- * two-step guard (R2) sets `"zone"` explicitly for step 1, so the safe
- * default for a single-shot deploy is everything.
- */
-export declare const DOMAIN_DEPLOY_DEFAULT_PHASE: DomainDeployPhase;
+export { DOMAIN_DEPLOY_DEFAULT_PHASE, type DomainDeployPhase } from "@fjall/util";

package/dist/lib/utils/domainTypes.js

@@ -58,8 +58,11 @@ export function resolveRecordFqdn(recordName, zoneName) {
     return `${recordName}.${zoneName}`;
 }
 /**
- * Default deploy phase when `phase` is omitted — the complete build. The
- * two-step guard (R2) sets `"zone"` explicitly for step 1, so the safe
- * default for a single-shot deploy is everything.
+ * Two-step deploy phase for constructs whose certificates must not be issued
+ * before their zone's NS delegation has propagated (design R2 cert-hang
+ * guard) plus its omitted-phase default — homed in `@fjall/util`
+ * (`infra/domainExports.ts`, the lowest common layer) and re-exported here
+ * so construct-side consumers keep their import path. deploy-core's
+ * `orchestration/domain/types.ts` re-exports the same declaration.
  */
-export const DOMAIN_DEPLOY_DEFAULT_PHASE = "full";
+export { DOMAIN_DEPLOY_DEFAULT_PHASE } from "@fjall/util";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.4.1",
+  "version": "3.6.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.4.1",
-    "@fjall/util": "^3.4.1",
+    "@fjall/generator": "^3.6.0",
+    "@fjall/util": "^3.6.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "6d8ef9582d5abe6a8199431815dae761887c18d4"
+  "gitHead": "10366db602d7e80669e22825a52071a47e05c3b7"
 }