@fjall/components-infrastructure 3.7.0 → 3.8.0

package/dist/lib/config/aws/alarmTopic.d.ts

@@ -8,8 +8,24 @@ import { Construct } from "constructs";
  * producer.
  */
 export declare const SHARED_ALARM_TOPIC_EXPORT_NAME = "SharedAlarmTopicArn";
+export interface SharedAlarmTopicProps {
+    /**
+     * Delivery endpoints for alarm notifications. Without at least one
+     * subscription the topic receives every ALARM/OK transition and drops it —
+     * alarms exist but page nobody.
+     *
+     * `emails` require the recipient to click SNS's confirmation email before
+     * delivery starts. `httpsEndpoints` must speak the SNS webhook protocol
+     * (SubscriptionConfirmation handshake); the Fjall webapp ingest at
+     * `/api/internal/alarm-webhook` does.
+     */
+    subscriptions?: {
+        emails?: string[];
+        httpsEndpoints?: string[];
+    };
+}
 export declare class SharedAlarmTopic extends Construct {
     readonly topic: ITopic;
     readonly topicArn: CfnOutput;
-    constructor(scope: Construct, id: string);
+    constructor(scope: Construct, id: string, props?: SharedAlarmTopicProps);
 }

package/dist/lib/config/aws/alarmTopic.js

@@ -1,4 +1,5 @@
 import { CfnOutput } from "aws-cdk-lib";
+import { EmailSubscription, UrlSubscription } from "aws-cdk-lib/aws-sns-subscriptions";
 import { Construct } from "constructs";
 import { SNSTopic } from "../../resources/aws/messaging/sns.js";
 /**
@@ -11,12 +12,18 @@ export const SHARED_ALARM_TOPIC_EXPORT_NAME = "SharedAlarmTopicArn";
 export class SharedAlarmTopic extends Construct {
     topic;
     topicArn;
-    constructor(scope, id) {
+    constructor(scope, id, props) {
         super(scope, id);
         const wrapped = new SNSTopic(this, "AlarmNotifications", {
             displayName: "Fjall CloudWatch Alarm Notifications"
         });
         this.topic = wrapped.getTopic();
+        for (const email of props?.subscriptions?.emails ?? []) {
+            this.topic.addSubscription(new EmailSubscription(email));
+        }
+        for (const endpoint of props?.subscriptions?.httpsEndpoints ?? []) {
+            this.topic.addSubscription(new UrlSubscription(endpoint));
+        }
         // SharedAlarmTopicArn is a well-known cross-stack export consumed via
         // Fn.importValue (see resolveAlertsTopic + its tests). Do not delete
         // thinking it duplicates the wrapper's AlarmNotificationsTopicArn —

package/dist/lib/patterns/aws/account.d.ts

@@ -1,4 +1,5 @@
 import { Stack, type StackProps } from "aws-cdk-lib";
+import { type SharedAlarmTopicProps } from "../../config/aws/index.js";
 import { type Construct } from "constructs";
 import { ConfigRulePreset } from "../../config/aws/configRulePreset.js";
 import { GuardDutyDetector } from "../../config/aws/guardDutyDetector.js";
@@ -25,6 +26,13 @@ export interface AccountProps extends StackProps {
      * persisted anywhere the deploy flow could read it).
      */
     securityTier?: GovernancePreset;
+    /**
+     * Delivery endpoints for the account's shared alarm topic. Undefined ⇒
+     * the topic synthesises with no subscribers and every alarm transition is
+     * dropped. Sourced from the generated `account/infrastructure.ts`, same as
+     * `securityTier`.
+     */
+    alarmSubscriptions?: SharedAlarmTopicProps["subscriptions"];
 }
 export declare class Account extends Stack {
     readonly organisationType: OrganisationType;

package/dist/lib/patterns/aws/account.js

@@ -48,7 +48,11 @@ export class Account extends Stack {
             exportName: "AccountId",
             description: "AWS Account ID for this account"
         });
-        new SharedAlarmTopic(this, "AlarmTopic");
+        new SharedAlarmTopic(this, "AlarmTopic", {
+            ...(props.alarmSubscriptions !== undefined && {
+                subscriptions: props.alarmSubscriptions
+            })
+        });
         const isStandaloneAccount = this.constructor === Account;
         const ipamPoolId = this.node.tryGetContext("ipamPoolId");
         if (isStandaloneAccount && ipamPoolId && this.resolvedRegion) {

package/dist/lib/patterns/aws/database.js

@@ -427,7 +427,10 @@ export class RelationalDatabase extends Construct {
             databaseInsights: props.databaseInsights,
             deletionProtection: props.deletionProtection,
             snapshotIdentifier: props.snapshotIdentifier,
-            snapshotUsername: props.snapshotUsername
+            snapshotUsername: props.snapshotUsername,
+            alertsTopic: this.resolveAlertsTopic(props.alertsTopic),
+            alarms: props.alarms,
+            applicationId: props.applicationId
         });
         this.connections = this.database.connections;
         this.addDatabaseOutputs(props);

package/dist/lib/patterns/aws/devSubstrate.js

@@ -1,7 +1,7 @@
 import { CfnOutput, Duration, Stack, Tags } from "aws-cdk-lib";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Cluster } from "aws-cdk-lib/aws-ecs";
-import { Repository } from "aws-cdk-lib/aws-ecr";
+import { Repository, TagMutability } from "aws-cdk-lib/aws-ecr";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { Code, Runtime } from "aws-cdk-lib/aws-lambda";
 import { PublicHostedZone } from "aws-cdk-lib/aws-route53";
@@ -238,10 +238,17 @@ export class DevSubstrate extends Construct {
         // getDefaultContainerRegistry's `${stackPrefix}Ecr`.
         const slotEcrId = `${toPascalCase(this.app.getName())}${DEV_SUBSTRATE_SLOT_ECR_ID}`;
         const slotEcrRepositoryName = `${devFenceName(props.appKebab)}-slots`;
-        // Adopt-mode is an import only — no CFN resource, so it carries no fence tags.
+        // Adopt-mode is an import only — no CFN resource, so it carries no fence tags
+        // (nor mutability convergence — a pre-BUG-22 adopted repo keeps IMMUTABLE
+        // until flipped out-of-band).
         const slotRepository = props.adoptSlotEcr === true
             ? Repository.fromRepositoryName(this, slotEcrId, slotEcrRepositoryName)
-            : new Ecr(this, slotEcrId, { repositoryName: slotEcrRepositoryName });
+            : new Ecr(this, slotEcrId, {
+                repositoryName: slotEcrRepositoryName,
+                // Every `fjall dev up` repushes the branch tag; IMMUTABLE breaks the
+                // first same-branch recreate (BUG-22).
+                tagMutability: TagMutability.MUTABLE
+            });
         return {
             vpc,
             slotSecurityGroup,

package/dist/lib/patterns/aws/devSubstrate.waker.source.cjs

@@ -1,9 +1,13 @@
 "use strict";
 
 // Dev-substrate slot waker, invoked as an ALB Lambda target. Milestone
-// placeholder — the real wake-token check + ECS/Aurora resume land in §5.4.
+// placeholder - the real wake-token check + ECS/Aurora resume land in 5.4.
 // ALB Lambda-target responses MUST carry all five fields; a missing
 // statusDescription or isBase64Encoded 502s at the ALB.
+// ASCII-ONLY FILE: this source ships inline as the template ZipFile, and
+// CloudFormation GetTemplate lossily transcodes non-ASCII to "?" - a single
+// non-ASCII byte here wedges recreate/forget surgery on the Compute stack
+// (the flip proof reports Code as directly modified). Pinned by test.
 exports.handler = async () => ({
   statusCode: 200,
   statusDescription: "200 OK",

package/dist/lib/patterns/aws/messaging.d.ts

@@ -1,12 +1,14 @@
 import { type Construct } from "constructs";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
 import { type IEventBus } from "aws-cdk-lib/aws-events";
+import type { ITopic } from "aws-cdk-lib/aws-sns";
 import type App from "../../app.js";
 import { SQSQueue } from "../../resources/aws/messaging/sqs.js";
 import { SNSTopic, type SNSTopicProps } from "../../resources/aws/messaging/sns.js";
 import { EventBridgeBus } from "../../resources/aws/messaging/eventbridge.js";
 import { type RemovalPolicyString } from "../../resources/aws/messaging/utils.js";
 import { Subscription, type SubscriptionProps } from "../../resources/aws/messaging/subscription.js";
+import { type SqsAlarmThresholds } from "../../resources/aws/monitoring/index.js";
 import { type IQueueMessaging, type ITopicMessaging, type IEventBusMessaging, type AnyMessaging } from "./interfaces/messaging.js";
 import { type IQueueConnector } from "./interfaces/connector.js";
 /**
@@ -31,6 +33,16 @@ export interface IQueueProps {
     fifoThroughputLimit?: "perQueue" | "perMessageGroupId";
     deduplicationScope?: "queue" | "messageGroup";
     removalPolicy?: RemovalPolicyString;
+    /**
+     * SNS topic for the DLQ-depth alarm. Accepts ITopic, ARN string, or
+     * "import:ExportName" (production apps use "import:SharedAlarmTopicArn").
+     * Only queues with `deadLetterQueue.enabled` gain the alarm.
+     */
+    alertsTopic?: ITopic | string;
+    /** Alarm thresholds. false to disable, undefined for defaults, object to override. */
+    alarms?: SqsAlarmThresholds | false;
+    /** Application ID for alarm tagging. */
+    applicationId?: string;
 }
 /**
  * Topic messaging props with type discriminator. Extends SNSTopicProps so the

package/dist/lib/patterns/aws/messaging.js

@@ -4,6 +4,7 @@ import { SNSTopic } from "../../resources/aws/messaging/sns.js";
 import { EventBridgeBus } from "../../resources/aws/messaging/eventbridge.js";
 import { Subscription } from "../../resources/aws/messaging/subscription.js";
 import { FjallLogger } from "../../utils/validationLogger.js";
+import { resolveAlertsTopic } from "../../utils/resolveAlertsTopic.js";
 /**
  * Validates SQS props and logs warnings for misconfigured options.
  */
@@ -88,7 +89,11 @@ export class QueueMessaging extends SQSQueue {
             contentBasedDeduplication: props.contentBasedDeduplication,
             fifoThroughputLimit: props.fifoThroughputLimit,
             deduplicationScope: props.deduplicationScope,
-            removalPolicy: props.removalPolicy
+            removalPolicy: props.removalPolicy,
+            // Resolved in the parent scope — `this` does not exist before super().
+            alertsTopic: resolveAlertsTopic(scope, `${id}AlertsTopic`, props.alertsTopic),
+            alarms: props.alarms,
+            applicationId: props.applicationId
         };
         super(scope, id, queueProps);
     }

package/dist/lib/resources/aws/compute/persistentDataVolume.d.ts

@@ -39,7 +39,8 @@ export interface PersistentDataVolumeProps {
     /**
      * SNS topic `attachFailureAlarm` notifies. Omitted, the alarm still exists
      * but fires no action — pass the stack's alerts topic or the failure is
-     * only visible to someone watching the CloudWatch console.
+     * only visible to someone watching the CloudWatch console. Also wires the
+     * re-attach queue's DLQ-depth alarm (created only when the topic is set).
      */
     alarmTopic?: ITopic;
 }

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -110,7 +110,8 @@ export class PersistentDataVolume extends Construct {
             // Transient volume-attach signals — no durable state (the EBS volume
             // itself is SNAPSHOT above). Pinned DESTROY (now also the SQSQueue wrapper
             // default) so a replacing deploy reclaims this queue + DLQ, not orphans.
-            removalPolicy: "DESTROY"
+            removalPolicy: "DESTROY",
+            alertsTopic: props.alarmTopic
         });
         const sourcePath = path.resolve(__dirname, LAUNCHING_LAMBDA_SOURCE_FILE);
         const source = readFileSync(sourcePath, "utf-8");

package/dist/lib/resources/aws/messaging/eventBridgeRule.js

@@ -5,6 +5,7 @@ import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { SQSQueue } from "./sqs.js";
 import { resolveTarget } from "./eventTargets.js";
 import { createScheduleAlarms } from "../monitoring/scheduleAlarms.js";
+import { createSqsDlqAlarms } from "../monitoring/sqsAlarms.js";
 /**
  * Build the default description for a Schedule.
  */
@@ -31,7 +32,8 @@ export class EventBridgeRule extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.id = id;
-        const dlq = this.#resolveOrProvisionDlq(id, props.deadLetterQueue);
+        const dlqResolution = this.#resolveOrProvisionDlq(id, props.deadLetterQueue);
+        const dlq = dlqResolution?.queue;
         if (dlq !== undefined)
             this.deadLetterQueue = dlq;
         grantKmsDecryptToEventBridge(dlq);
@@ -53,20 +55,24 @@ export class EventBridgeRule extends Construct {
             crossStackScope: props.crossStackScope,
             targets: [targetAdapter]
         });
-        provisionAlarms(this, id, props, this.#rule, dlq);
+        provisionAlarms(this, id, props, this.#rule, dlqResolution);
     }
     #resolveOrProvisionDlq(id, prop) {
         if (prop === undefined)
             return undefined;
         if (prop instanceof SQSQueue)
-            return prop;
+            return { queue: prop, provisioned: false };
         if (prop.enabled === false)
             return undefined;
-        if ("queue" in prop && prop.queue !== undefined)
-            return prop.queue;
-        return new SQSQueue(this, `${id}Dlq`, {
-            queueType: "standard"
-        });
+        if ("queue" in prop && prop.queue !== undefined) {
+            return { queue: prop.queue, provisioned: false };
+        }
+        return {
+            queue: new SQSQueue(this, `${id}Dlq`, {
+                queueType: "standard"
+            }),
+            provisioned: true
+        };
     }
     getRule() {
         return this.#rule;
@@ -107,4 +113,18 @@ function provisionAlarms(scope, id, props, rule, dlq) {
         applicationId: props.applicationId,
         dlqEnabled: dlq !== undefined
     });
+    // Depth alarm only on the rule-provisioned DLQ — a BYO/shared queue would
+    // collect one duplicate alarm per referencing rule; its owner alarms it.
+    if (dlq !== undefined && dlq.provisioned) {
+        createSqsDlqAlarms({
+            scope,
+            queueName: id,
+            deadLetterQueue: dlq.queue.getQueue(),
+            config: props.alarmConfig?.dlqDepthThreshold !== undefined
+                ? { dlqDepthThreshold: props.alarmConfig.dlqDepthThreshold }
+                : {},
+            alarmTopic: props.alertsTopic,
+            applicationId: props.applicationId
+        });
+    }
 }

package/dist/lib/resources/aws/messaging/sqs.d.ts

@@ -1,7 +1,9 @@
 import { Construct } from "constructs";
 import { type IQueue } from "aws-cdk-lib/aws-sqs";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
+import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type RemovalPolicyString } from "./utils.js";
+import { type SqsAlarmThresholds } from "../monitoring/index.js";
 /**
  * AWS SQS service limits and defaults.
  * @see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-quotas.html
@@ -67,6 +69,20 @@ export interface SQSQueueProps {
      * irreplaceable and must survive stack deletion.
      */
     removalPolicy?: RemovalPolicyString;
+    /**
+     * SNS topic for the DLQ-depth alarm. When set (and `alarms` is not false),
+     * the auto-created dead-letter queue gains an alarm that fires on any
+     * visible message — a dead-lettered message means a consumer exhausted its
+     * receive budget, and an unwatched DLQ ages messages out silently after
+     * 14 days. BYO DLQs (`deadLetterQueue.queue`) are not alarmed here: the
+     * queue's owner wires its alarms, and a shared DLQ would otherwise collect
+     * one duplicate alarm per referencing queue.
+     */
+    alertsTopic?: ITopic;
+    /** Alarm thresholds. false to disable, undefined for defaults, object to override. */
+    alarms?: SqsAlarmThresholds | false;
+    /** Application ID for alarm tagging. */
+    applicationId?: string;
 }
 export declare class SQSQueue extends Construct {
     readonly id: string;

package/dist/lib/resources/aws/messaging/sqs.js

@@ -3,6 +3,7 @@ import { CfnOutput, Duration } from "aws-cdk-lib";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { Queue, QueueEncryption, FifoThroughputLimit, DeduplicationScope } from "aws-cdk-lib/aws-sqs";
 import { toRemovalPolicy } from "./utils.js";
+import { createSqsDlqAlarms } from "../monitoring/index.js";
 /**
  * AWS SQS service limits and defaults.
  * @see https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-quotas.html
@@ -181,6 +182,16 @@ export class SQSQueue extends Construct {
             value: this.queue.queueName,
             description: `SQS queue name for ${id}`
         });
+        if (props.alertsTopic && props.alarms !== false && this.dlq !== undefined) {
+            createSqsDlqAlarms({
+                scope: this,
+                queueName: id,
+                deadLetterQueue: this.dlq,
+                config: typeof props.alarms === "object" ? props.alarms : {},
+                alarmTopic: props.alertsTopic,
+                applicationId: props.applicationId
+            });
+        }
     }
     /**
      * Get the SQS queue URL.

package/dist/lib/resources/aws/monitoring/alarmDefaults.d.ts

@@ -27,6 +27,9 @@ export declare const ALARM_DEFAULTS: {
         readonly ERROR_RATE: 5;
         readonly DURATION_PERCENT: 80;
     };
+    readonly SQS: {
+        readonly DLQ_VISIBLE_MESSAGES: 0;
+    };
 };
 /** Build alarm description, appending the application ID tag for webhook extraction. */
 export declare function buildAlarmDescription(baseDescription: string, applicationId: string | undefined): string;

package/dist/lib/resources/aws/monitoring/alarmDefaults.js

@@ -10,7 +10,8 @@ export const ALARM_DEFAULTS = {
     ECS: { CPU: 80, MEMORY: 80, RUNNING_TASKS_MIN: 1 },
     ALB: { HTTP_5XX_PERCENT: 5, P99_RESPONSE_TIME_MS: 3000 },
     RDS: { CPU: 80, FREE_STORAGE_GIB: 5, CONNECTIONS: 50 },
-    LAMBDA: { ERROR_RATE: 5, DURATION_PERCENT: 80 }
+    LAMBDA: { ERROR_RATE: 5, DURATION_PERCENT: 80 },
+    SQS: { DLQ_VISIBLE_MESSAGES: 0 }
 };
 /** Build alarm description, appending the application ID tag for webhook extraction. */
 export function buildAlarmDescription(baseDescription, applicationId) {

package/dist/lib/resources/aws/monitoring/index.d.ts

@@ -3,6 +3,7 @@ export { createEcsServiceAlarms, type EcsServiceAlarmThresholds, type EcsService
 export { createRdsAlarms, type RdsAlarmThresholds, type RdsAlarmsProps } from "./rdsAlarms.js";
 export { createLambdaAlarms, type LambdaAlarmThresholds, type LambdaAlarmsProps } from "./lambdaAlarms.js";
 export { createScheduleAlarms, type ScheduleAlarmThresholds, type CreateScheduleAlarmsProps } from "./scheduleAlarms.js";
+export { createSqsDlqAlarms, type SqsAlarmThresholds, type SqsDlqAlarmsProps } from "./sqsAlarms.js";
 export { createClickHouseAlarms, type ClickHouseAlarmThresholds, type ClickHouseAlarmsProps } from "./clickhouseAlarms.js";
 export { createBuildkiteAlarms, type BuildkiteAlarmsProps } from "./buildkiteAlarms.js";
 export { createLogPatternAlarms, type LogPatternAlarmSpec, type LogPatternAlarmsProps } from "./logPatternAlarms.js";

package/dist/lib/resources/aws/monitoring/index.js

@@ -3,6 +3,7 @@ export { createEcsServiceAlarms } from "./ecsAlarms.js";
 export { createRdsAlarms } from "./rdsAlarms.js";
 export { createLambdaAlarms } from "./lambdaAlarms.js";
 export { createScheduleAlarms } from "./scheduleAlarms.js";
+export { createSqsDlqAlarms } from "./sqsAlarms.js";
 export { createClickHouseAlarms } from "./clickhouseAlarms.js";
 export { createBuildkiteAlarms } from "./buildkiteAlarms.js";
 export { createLogPatternAlarms } from "./logPatternAlarms.js";

package/dist/lib/resources/aws/monitoring/scheduleAlarms.d.ts

@@ -17,6 +17,12 @@ export interface ScheduleAlarmThresholds {
      * expected cadence (silent disablement detector).
      */
     matchedEventsLowFloorRatio?: number;
+    /**
+     * Visible-message count above which the rule's DLQ-depth alarm fires
+     * (`createSqsDlqAlarms`, wired by `eventBridgeRule.ts` when a DLQ exists).
+     * Default 0 — any dead-lettered event pages.
+     */
+    dlqDepthThreshold?: number;
 }
 export interface CreateScheduleAlarmsProps {
     scope: Construct;

package/dist/lib/resources/aws/monitoring/sqsAlarms.d.ts

@@ -0,0 +1,23 @@
+import { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import type { IQueue } from "aws-cdk-lib/aws-sqs";
+import type { ITopic } from "aws-cdk-lib/aws-sns";
+import type { Construct } from "constructs";
+export interface SqsAlarmThresholds {
+    /** Visible-message count above which the DLQ-depth alarm fires. Default 0 — any dead-lettered message pages. */
+    dlqDepthThreshold?: number;
+}
+export interface SqsDlqAlarmsProps {
+    scope: Construct;
+    queueName: string;
+    deadLetterQueue: IQueue;
+    config: SqsAlarmThresholds;
+    alarmTopic: ITopic;
+    applicationId?: string;
+}
+/**
+ * DLQ-depth alarm: fires when the dead-letter queue holds any visible
+ * message. A dead-lettered message is a single-event failure (a poison
+ * message has exhausted its receive budget), so this uses the 1/1
+ * single-event evaluation shape rather than the utilisation 3/2 shape.
+ */
+export declare function createSqsDlqAlarms(props: SqsDlqAlarmsProps): Alarm[];

package/dist/lib/resources/aws/monitoring/sqsAlarms.js

@@ -0,0 +1,29 @@
+import { Alarm, ComparisonOperator, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
+import { ALARM_DEFAULTS, registerAlarm, tagAlarmsWithApplicationId, buildAlarmDescription } from "./alarmDefaults.js";
+/**
+ * DLQ-depth alarm: fires when the dead-letter queue holds any visible
+ * message. A dead-lettered message is a single-event failure (a poison
+ * message has exhausted its receive budget), so this uses the 1/1
+ * single-event evaluation shape rather than the utilisation 3/2 shape.
+ */
+export function createSqsDlqAlarms(props) {
+    const { scope, queueName, deadLetterQueue, config, alarmTopic, applicationId } = props;
+    const alarms = [];
+    const snsAction = new SnsAction(alarmTopic);
+    const dlqDepthAlarm = new Alarm(scope, `${queueName}DlqDepthAlarm`, {
+        alarmDescription: buildAlarmDescription(`Dead-letter queue for ${queueName} contains messages`, applicationId),
+        metric: deadLetterQueue.metricApproximateNumberOfMessagesVisible({
+            period: ALARM_DEFAULTS.EVALUATION_PERIOD,
+            statistic: "Maximum"
+        }),
+        threshold: config.dlqDepthThreshold ?? ALARM_DEFAULTS.SQS.DLQ_VISIBLE_MESSAGES,
+        evaluationPeriods: 1,
+        datapointsToAlarm: 1,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+        treatMissingData: TreatMissingData.NOT_BREACHING
+    });
+    registerAlarm(dlqDepthAlarm, snsAction, alarms);
+    tagAlarmsWithApplicationId(alarms, applicationId);
+    return alarms;
+}

package/dist/lib/resources/aws/storage/ecr.d.ts

@@ -1,9 +1,12 @@
 import { type Construct } from "constructs";
-import { Repository, type RepositoryProps } from "aws-cdk-lib/aws-ecr";
+import { Repository, type RepositoryProps, TagMutability } from "aws-cdk-lib/aws-ecr";
 import type App from "../../../app.js";
 import { type StackBuilder } from "../base/awsStack.js";
 interface EcrProps {
     repositoryName?: string;
+    /** Default IMMUTABLE (supply-chain guard). Dev-slot repos MUST pass MUTABLE —
+     *  every `fjall dev up` repushes the branch tag (BUG-22). */
+    tagMutability?: TagMutability;
 }
 export declare class EcrFactory {
     static build(id: string, props?: EcrProps): (app: App, scope: Construct) => Ecr;

package/dist/lib/resources/aws/storage/ecr.js

@@ -29,7 +29,7 @@ export class Ecr extends Repository {
         return {
             ...(props?.repositoryName && { repositoryName: props.repositoryName }),
             imageScanOnPush: true,
-            imageTagMutability: TagMutability.IMMUTABLE,
+            imageTagMutability: props?.tagMutability ?? TagMutability.IMMUTABLE,
             emptyOnDelete: false,
             removalPolicy: RemovalPolicy.RETAIN
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^3.7.0",
-    "@fjall/util": "^3.7.0",
+    "@fjall/generator": "^3.8.0",
+    "@fjall/util": "^3.8.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "2ee5e51bc6aa45e34ec70160b36ddf976371ccd5"
+  "gitHead": "9a137b6bd380f432f6c6e8e43b7932dec0b64a13"
 }