@fjall/components-infrastructure 32.0.0 → 33.1.0

package/README.md

@@ -54,84 +54,23 @@ for each of the two secrets.
 
 ## Useful commands
 
-- `npm run build` compile typescript to js
-- `npm run watch` watch for changes and compile
-- `npm run test` perform the jest unit tests
-- `cdk deploy` deploy this stack to your default AWS account/region
-- `cdk diff` compare deployed stack with current state
-- `cdk synth` emits the synthesized CloudFormation template
+- `npm run build` — clean, bundle the Lambda assets and compile TypeScript to `dist/`
+- `npm run watch` — recompile on change
+- `npm test` — run the Vitest suites
+- `npm run typecheck` — type-check the library
 
-## Building patterns
+Synthesis and deployment go through the `fjall` CLI (`fjall deploy`), which
+assembles the stacks from an application's `fjall/` directory. The package is
+not deployed with `cdk deploy` on its own.
 
-Common service patterns are built using a Stack class (i.e AwsStack) and use a builder pattern.
+## Using the constructs
 
-### Referencing VPC
+The constructs are consumed through the `fjall` CLI: `fjall create app` and
+`fjall add <resource>` write the `infrastructure.ts` that composes them, and
+`fjall deploy` synthesises and deploys it. Every construct is also exported
+from the package root for direct use; the reference lives at
+[docs.fjall.io](https://docs.fjall.io).
 
-There are three main ways to reference a VPC
+## Licence
 
-1. In the same stack
-
-When a VPC is created in the same stack resources that rely on it will automatically detect it.
-
-```typescript
-new AwsStack(`${id}App`)
-  .addNetwork(FjallVpc.build(`${id}Vpc`))
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-2. In the same CDK Application but different stack
-
-When a VPC is created in the same application, but you want to use separate stacks, you can directly reference the vpc resource itself. This is easily
-retrieved from an awsStack using `awsStack.getNetwork()`.
-
-```typescript
-const vpcStack = new AwsStack(`${id}Network`).addNetwork(
-  FjallVpc.build(`${id}Vpc`)
-);
-
-const newStack = new AwsStack(`${id}Compute`, { dependencies: [vpcStack] })
-  .addNetwork(vpcStack.getNetwork())
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-3. Different CDK Applications
-
-If your VPC was created in a completely separate CDK Stack it can be imported using it's `id` and `stackName`. However this method
-requires you explicitly configure your `AwsStack` with an `account` and `region.
-
-```typescript
-const env = {
-  region: "us-east-1",
-  account: "058430617814"
-};
-
-const vpcStack = new AwsStack(`${id}Network`, { ...env }).addNetwork(
-  FjallVpc.build(`${id}Vpc`)
-);
-
-const newStack = new AwsStack(`${id}Compute`, {
-  ...env,
-  dependencies: [vpcStack]
-})
-  .addNetwork(FjallVpc.import(`${id}Vpc`, `${id}Network`))
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-## Publishing package to npm
-
-Log into your NPM account locally (make sure you have 2fa setup before trying this)
-
-```
-npm login
-> Username:
-> Password
-> Email
-> 2Fa
-```
-
-Update the version in ./package.json, build the package and then run publish command
-
-```
-npm run build
-npm publish --access restricted
-```
+Proprietary — see [LICENSE](./LICENSE).

package/dist/lib/app.d.ts

@@ -311,7 +311,7 @@ export declare class App extends CdkApp {
     addDevSubstrate(props: IDevSubstrateProps): DevSubstrate;
     /**
      * Instantiate the self-hosted Buildkite agent fleet on the default compute
-     * stack (design `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`).
+     * stack (design: the 2026-07-18 Buildkite self-hosted agents design).
      *
      * Same placement contract as `addDevSubstrate` above: deploy-core selects
      * stacks by the fixed six-category enum, so scoping under

package/dist/lib/config/audit.js

@@ -1,3 +1,4 @@
+import { FJALL_PLATFORM_ACCOUNT_ID } from "./aws/platform.js";
 /**
  * Audit configuration for cross-account CloudQuery access
  */
@@ -6,7 +7,7 @@ export const FJALL_AUDIT_CONFIG = {
      * Fjall webapp AWS account ID
      * This account will be granted permission to assume audit roles for CloudQuery
      */
-    webappAwsAccountId: "985539798308", // Fjall platform account
+    webappAwsAccountId: FJALL_PLATFORM_ACCOUNT_ID,
     /**
      * IAM role naming convention
      */

package/dist/lib/config/aws/identityCentreConfig.d.ts

@@ -4,7 +4,7 @@ import { type DefaultPermissionSetName } from "@fjall/generator";
  * construct. The discriminated union on `source` mirrors AWS ground truth:
  * the identity source of an Identity Center instance is neither readable nor
  * settable via any supported API, so the mode is user-declared and
- * authoritative. Design: aiDocs/designs/2026-07-04-org-user-management-design.md
+ * authoritative. Design: the 2026-07-04 organisation user-management design.
  *
  * The source vocabulary is canonical in @fjall/generator
  * (organisationSchemas.ts) — re-exported here so existing consumers keep

package/dist/lib/config/aws/identityCentreConfig.js

@@ -5,7 +5,7 @@ import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
  * construct. The discriminated union on `source` mirrors AWS ground truth:
  * the identity source of an Identity Center instance is neither readable nor
  * settable via any supported API, so the mode is user-declared and
- * authoritative. Design: aiDocs/designs/2026-07-04-org-user-management-design.md
+ * authoritative. Design: the 2026-07-04 organisation user-management design.
  *
  * The source vocabulary is canonical in @fjall/generator
  * (organisationSchemas.ts) — re-exported here so existing consumers keep

package/dist/lib/config/aws/scpPreset.js

@@ -140,8 +140,7 @@ function buildFoundationGuardrails(allowedRegions) {
                 // assume-root sessions) are deliberately NOT carved out — recovery on
                 // this tier is a break-glass SCP detach, not a standing carve-out. Do
                 // not add them without revisiting the decision:
-                // aiDocs/troubleshooting/centralised-root-access-break-glass-runbook.md
-                // § Scenario 3.
+                // the centralised root-access break-glass runbook, § Scenario 3.
                 NotAction: [
                     "s3:GetBucketPolicy",
                     "s3:PutBucketPolicy",

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -18117,3 +18117,129 @@ exports.handler = async (event) => {
     Data: { CaCertSha256: caCertSha256 }
   };
 };
+/*! Bundled license information:
+
+reflect-metadata/Reflect.js:
+  (*! *****************************************************************************
+  Copyright (C) Microsoft. All rights reserved.
+  Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+  this file except in compliance with the License. You may obtain a copy of the
+  License at http://www.apache.org/licenses/LICENSE-2.0
+  
+  THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
+  WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
+  MERCHANTABLITY OR NON-INFRINGEMENT.
+  
+  See the Apache Version 2.0 License for specific language governing permissions
+  and limitations under the License.
+  ***************************************************************************** *)
+
+pvtsutils/build/index.js:
+  (*!
+   * MIT License
+   * 
+   * Copyright (c) 2017-2024 Peculiar Ventures, LLC
+   * 
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   * 
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   * 
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   * 
+   *)
+
+pvutils/build/utils.js:
+  (*!
+   Copyright (c) Peculiar Ventures, LLC
+  *)
+
+asn1js/build/index.js:
+  (*!
+   * Copyright (c) 2014, GMO GlobalSign
+   * Copyright (c) 2015-2022, Peculiar Ventures
+   * All rights reserved.
+   * 
+   * Author 2014-2019, Yury Strozhevsky
+   * 
+   * Redistribution and use in source and binary forms, with or without modification,
+   * are permitted provided that the following conditions are met:
+   * 
+   * * Redistributions of source code must retain the above copyright notice, this
+   *   list of conditions and the following disclaimer.
+   * 
+   * * Redistributions in binary form must reproduce the above copyright notice, this
+   *   list of conditions and the following disclaimer in the documentation and/or
+   *   other materials provided with the distribution.
+   * 
+   * * Neither the name of the copyright holder nor the names of its
+   *   contributors may be used to endorse or promote products derived from
+   *   this software without specific prior written permission.
+   * 
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+   * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+   * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+   * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+   * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+   * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   * 
+   *)
+
+tslib/tslib.es6.js:
+  (*! *****************************************************************************
+  Copyright (c) Microsoft Corporation.
+  
+  Permission to use, copy, modify, and/or distribute this software for any
+  purpose with or without fee is hereby granted.
+  
+  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+  REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+  INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+  OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
+  ***************************************************************************** *)
+
+@peculiar/x509/build/x509.cjs.js:
+  (*!
+   * MIT License
+   * 
+   * Copyright (c) Peculiar Ventures. All rights reserved.
+   * 
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   * 
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   * 
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   * 
+   *)
+*/

package/dist/lib/patterns/aws/buildkite/buildkite.d.ts

@@ -14,7 +14,7 @@ export type BuildkiteConstructProps = BuildkitePropsInput & {
  * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —
  * scale-to-zero ASG + buildkite-agent-scaler, no secret ever transiting
  * synth, allowlist-only instance IAM. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  *
  * A Construct, not a Stack: instantiate via `App.addBuildkite(props)`, which
  * scopes it under the default compute stack so deploy-core's fixed

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -21,7 +21,7 @@ import { buildBuildkiteUserData } from "./userData.js";
  * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —
  * scale-to-zero ASG + buildkite-agent-scaler, no secret ever transiting
  * synth, allowlist-only instance IAM. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  *
  * A Construct, not a Stack: instantiate via `App.addBuildkite(props)`, which
  * scopes it under the default compute stack so deploy-core's fixed

package/dist/lib/patterns/aws/buildkite/factory.d.ts

@@ -5,8 +5,8 @@ import type { BuildkitePropsInput } from "./schema.js";
 /**
  * Thunk returned by `BuildkiteFactory.build` — materialised only by
  * `App.addBuildkite`, which owns stack placement (the fleet has exactly one
- * legal home, `${stackPrefix}Compute`; design
- * `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D2).
+ * legal home, `${stackPrefix}Compute`; design:
+ * the 2026-07-18 `fjall add buildkite` design, § D2).
  */
 export type BuildkiteFactoryFn = (app: App, scope: Construct) => Buildkite;
 /**

package/dist/lib/patterns/aws/buildkite/pins.d.ts

@@ -4,7 +4,7 @@
  * release. AMI ids, the elastic-stack version, the scaler version and the
  * secrets-plugin floor MUST only change together, regenerated from the
  * upstream template for the new version (runbook:
- * `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * the Buildkite stack-bump runbook).
  *
  * AMI ids come from the `Mappings.AWSRegion2AMI` block of
  * `https://s3.amazonaws.com/buildkite-aws-stack/<version>/aws-stack.yml` and
@@ -18,7 +18,7 @@
  * floats the AMI underneath a pinned stack version, needs lookup credentials
  * at synth time (unavailable in worker synth), and makes synth
  * non-deterministic. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md` § D2.
+ * the 2026-07-18 Buildkite self-hosted agents design, § D2.
  */
 export declare const BUILDKITE_AMI_OWNER_ACCOUNT_ID = "172840064832";
 export declare const BUILDKITE_CPU_ARCHITECTURES: readonly ["arm64", "amd64"];

package/dist/lib/patterns/aws/buildkite/pins.js

@@ -4,7 +4,7 @@
  * release. AMI ids, the elastic-stack version, the scaler version and the
  * secrets-plugin floor MUST only change together, regenerated from the
  * upstream template for the new version (runbook:
- * `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * the Buildkite stack-bump runbook).
  *
  * AMI ids come from the `Mappings.AWSRegion2AMI` block of
  * `https://s3.amazonaws.com/buildkite-aws-stack/<version>/aws-stack.yml` and
@@ -18,7 +18,7 @@
  * floats the AMI underneath a pinned stack version, needs lookup credentials
  * at synth time (unavailable in worker synth), and makes synth
  * non-deterministic. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md` § D2.
+ * the 2026-07-18 Buildkite self-hosted agents design, § D2.
  */
 export const BUILDKITE_AMI_OWNER_ACCOUNT_ID = "172840064832";
 export const BUILDKITE_CPU_ARCHITECTURES = ["arm64", "amd64"];
@@ -69,8 +69,7 @@ export function resolvePinnedAmiId(region, architecture) {
     if (!isSupportedRegion(region)) {
         throw new Error(`Buildkite: no pinned AMI for region '${region}'. Supported: ` +
             `${Object.keys(BUILDKITE_STACK_PINS.amiIdsByRegion).join(", ")}. ` +
-            `Add the region to BUILDKITE_STACK_PINS via the bump runbook ` +
-            `(aiDocs/runbooks/buildkite-stack-bump-runbook.md).`);
+            `Add the region to BUILDKITE_STACK_PINS.`);
     }
     return BUILDKITE_STACK_PINS.amiIdsByRegion[region][architecture];
 }

package/dist/lib/patterns/aws/buildkite/schema.d.ts

@@ -2,7 +2,7 @@
  * Buildkite props schema — re-export barrel. The canonical declaration lives
  * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
  * validation, the codemod fragment, and the LLM JSON schema all consume one
- * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * source (design: the 2026-07-18 `fjall add buildkite` design, § D4).
  * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
 export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps, type BuildkiteProps, type BuildkitePropsInput, type BuildkitePropsObject } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/schema.js

@@ -2,7 +2,7 @@
  * Buildkite props schema — re-export barrel. The canonical declaration lives
  * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
  * validation, the codemod fragment, and the LLM JSON schema all consume one
- * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * source (design: the 2026-07-18 `fjall add buildkite` design, § D4).
  * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
 export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/userData.d.ts

@@ -29,7 +29,7 @@ export interface BuildkiteUserDataContext {
  * vendored template in both directions: a key we emit that upstream does not
  * pass is silently ignored; a key upstream passes that we omit is the
  * boot-loop. Bumping the pins regenerates the fixture
- * (runbook: `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * (runbook: the Buildkite stack-bump runbook).
  */
 export declare const BUILDKITE_MOUNT_PART_ENV_KEYS: readonly ["BUILDKITE_ENABLE_INSTANCE_STORAGE", "BUILDKITE_MOUNT_TMPFS_AT_TMP"];
 export declare const BUILDKITE_DOCKER_PART_ENV_KEYS: readonly ["DOCKER_USERNS_REMAP", "DOCKER_EXPERIMENTAL", "DOCKER_PRUNE_UNTIL", "ENABLE_PRE_EXIT_DISK_CLEANUP", "DOCKER_BUILDER_PRUNE_ENABLED", "DOCKER_NETWORKING_PROTOCOL", "DOCKER_IPV4_ADDRESS_POOL_1", "DOCKER_IPV4_ADDRESS_POOL_2", "DOCKER_IPV6_ADDRESS_POOL", "DOCKER_FIXED_CIDR_V4", "DOCKER_FIXED_CIDR_V6", "BUILDKITE_ENABLE_INSTANCE_STORAGE"];

package/dist/lib/patterns/aws/buildkite/userData.js

@@ -10,7 +10,7 @@ import { BUILDKITE_STACK_PINS } from "./pins.js";
  * vendored template in both directions: a key we emit that upstream does not
  * pass is silently ignored; a key upstream passes that we omit is the
  * boot-loop. Bumping the pins regenerates the fixture
- * (runbook: `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * (runbook: the Buildkite stack-bump runbook).
  */
 export const BUILDKITE_MOUNT_PART_ENV_KEYS = [
     "BUILDKITE_ENABLE_INSTANCE_STORAGE",

package/dist/lib/patterns/aws/buildkite.d.ts

@@ -2,7 +2,7 @@
  * Self-hosted Buildkite agent fleet — barrel for the `buildkite/` modules.
  * The pre-2026-07 `Buildkite extends Stack` implementation is replaced by a
  * Construct instantiated via `App.addBuildkite()`; design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  */
 export { AGENT_TOKEN_SECRET_NAME, BUILDKITE_SECRETS_CLUSTER, Buildkite, FJALL_API_KEY_SECRET_NAME, FJALL_ENV_HOOK_OBJECT_KEY, buildAgentSecretsEnvHookScript, type AgentSecretsEnvHookOptions, type BuildkiteConstructProps } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn, type BuildkiteCpuArchitecture } from "./buildkite/pins.js";

package/dist/lib/patterns/aws/buildkite.js

@@ -2,7 +2,7 @@
  * Self-hosted Buildkite agent fleet — barrel for the `buildkite/` modules.
  * The pre-2026-07 `Buildkite extends Stack` implementation is replaced by a
  * Construct instantiated via `App.addBuildkite()`; design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  */
 export { AGENT_TOKEN_SECRET_NAME, BUILDKITE_SECRETS_CLUSTER, Buildkite, FJALL_API_KEY_SECRET_NAME, FJALL_ENV_HOOK_OBJECT_KEY, buildAgentSecretsEnvHookScript } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn } from "./buildkite/pins.js";

package/dist/lib/patterns/aws/cdn.d.ts

@@ -7,6 +7,7 @@ import type App from "../../app.js";
 import { CloudFrontDistribution, type CachePolicyPreset, type AccessGateConfig } from "../../resources/aws/cdn/index.js";
 import { type ICdn } from "./interfaces/cdn.js";
 import { type StaticSiteRouting, type CloudFrontPriceClass } from "@fjall/util";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type ManagedDomainBinding, type ManagedDomainExports } from "../../utils/domainTypes.js";
 import { type Storage } from "./storage.js";
 import { type AnyCompute } from "./compute.js";
@@ -81,11 +82,24 @@ interface BaseCdnProps {
     certificate?: ICertificate;
     certificateArn?: string;
     comment?: string;
+    /**
+     * Standard (S3) access logging. Default: the app backup tier's
+     * `cloudFrontLogging` column — enterprise logs to the stack's shared,
+     * lifecycle-expired access-log bucket under `cloudfront/<id>/`. Set either
+     * knob to take over: `enableLogging: false` opts out at any tier,
+     * `logBucket` delivers to a bucket of your own.
+     */
     enableLogging?: boolean;
     logBucket?: IBucket;
     priceClass?: CloudFrontPriceClass;
     forwardHostHeader?: boolean;
     accessGate?: false | AccessGateConfig;
+    /**
+     * The owning app's backup tier, which the logging default follows.
+     * `CdnFactory.build` fills it from the `App`; only set by hand for a
+     * directly-instantiated `Cdn`.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * S3 origin CDN props - use with S3 bucket

package/dist/lib/patterns/aws/cdn.js

@@ -3,12 +3,40 @@ import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { CloudFrontTarget, LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { CloudFrontDistribution } from "../../resources/aws/cdn/index.js";
 import { AliasRecord } from "../../resources/aws/networking/index.js";
+import { tierDefault } from "../../utils/backupTierMapping.js";
+import { stackAccessLogBucket } from "../../resources/aws/logging/index.js";
 import { getSafeZoneName, toPascalCase } from "../../utils/capitaliseString.js";
 import { recordLabelWithin } from "../../utils/domainTypes.js";
 import { resolvePatternZone, resolvePatternCloudFrontCertificate } from "./patternDomain.js";
 import { isStorage } from "./storage.js";
 import { CdnEcsOriginResolver, cdnOriginRefusal, internalAlbMessage, normaliseDnsName } from "./cdnAppOrigin.js";
 import { isCompute, isEcsCompute, isLambdaCompute } from "./compute.js";
+/**
+ * An explicit `enableLogging` or `logBucket` is the override and passes
+ * through untouched; otherwise the tier decides, and a tier-enabled CDN logs
+ * to the stack's shared access-log bucket under its own prefix.
+ */
+function resolveCdnLogging(scope, id, props) {
+    if (props.enableLogging !== undefined || props.logBucket !== undefined) {
+        return {
+            enableLogging: props.enableLogging,
+            logBucket: props.logBucket,
+            logFilePrefix: undefined
+        };
+    }
+    if (!tierDefault(props.appBackupTier, "cloudFrontLogging")) {
+        return {
+            enableLogging: undefined,
+            logBucket: undefined,
+            logFilePrefix: undefined
+        };
+    }
+    return {
+        enableLogging: true,
+        logBucket: stackAccessLogBucket(scope),
+        logFilePrefix: `cloudfront/${id}/`
+    };
+}
 /**
  * The distribution's own alias names, normalised — consumed by the
  * origin-loop guard and by the ECS origin resolver (auto-resolution excludes
@@ -458,8 +486,7 @@ export class Cdn extends CloudFrontDistribution {
                 domainNames,
                 certificate,
                 comment: props.comment,
-                enableLogging: props.enableLogging,
-                logBucket: props.logBucket,
+                ...resolveCdnLogging(scope, id, props),
                 priceClass: props.priceClass,
                 forwardHostHeader: props.forwardHostHeader ?? impliedForwardHostHeader,
                 accessGate: props.accessGate,
@@ -676,7 +703,8 @@ export class CdnFactory {
             return new Cdn(scope, id, {
                 ...props,
                 appName: props.appName ?? app.getName(),
-                app: props.app ?? app
+                app: props.app ?? app,
+                appBackupTier: props.appBackupTier ?? app.getBackupTier()
             });
         };
     }

package/dist/lib/patterns/aws/clickhouseDatabase.d.ts

@@ -3,6 +3,7 @@ import { type TaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type IBucket } from "aws-cdk-lib/aws-s3";
 import { Construct } from "constructs";
 import { Secret, type SecretImport } from "../../resources/aws/secrets/secret.js";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type ClickHouseAlarmThresholds } from "../../resources/aws/monitoring/index.js";
 import { type ClickHouseSchemaAdmin, type ProfileSpec } from "../../resources/aws/database/clickhouseSchemas.js";
 import { type ISecret } from "aws-cdk-lib/aws-secretsmanager";
@@ -283,6 +284,13 @@ export interface ClickHouseDatabaseProps {
      * RDS branch of `DatabaseFactory.build`.
      */
     applicationId?: string;
+    /**
+     * The owning app's backup tier, which the tier-owned defaults of the
+     * compute this pattern builds (Container Insights, exec-session and
+     * log-group encryption) follow. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new ClickHouseDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Public-facing re-export of the alarm knob so factory consumers can type

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -15,6 +15,8 @@ import App from "../../app.js";
 import { S3Bucket } from "../../resources/aws/storage/s3.js";
 import { Secret } from "../../resources/aws/secrets/secret.js";
 import { LogGroup } from "../../resources/aws/logging/logGroup.js";
+import { StackEncryptionKey } from "../../resources/aws/secrets/stackEncryptionKey.js";
+import { tierDefault } from "../../utils/backupTierMapping.js";
 import { createClickHouseSecurityGroup } from "../../resources/aws/database/clickhouseSecurityGroup.js";
 import { buildMaintenancePreamble, maintenanceOkMarker, maintenanceRun } from "../../resources/aws/database/clickhouseMaintenanceScript.js";
 import { buildClickHouseEntrypointWrapper, buildClickHouseUserData, generateUsersConfigXml } from "../../resources/aws/database/clickhouseUserData.js";
@@ -379,22 +381,33 @@ export class ClickHouseDatabase extends Construct {
         const coldTierBucket = coldTierEnabled
             ? (props.coldTierBucket ??
                 new S3Bucket(this, "ClickHouseColdTierBucket", {
-                    versioned: false
+                    // Tiered table parts, re-tiered from hot storage — versioning would
+                    // only bill for churn; the exemption stamp tells posture so.
+                    versioned: false,
+                    versioningExemption: "cold-tier"
                 }))
             : undefined;
         this.#backupBucket = backupBucket;
         this.#coldTierBucket = coldTierBucket;
         this.#migrationsConfig = props.migrations;
+        // The maintenance-task log groups sit beside the compute's own container
+        // and exec-audit groups and follow the same tier: the stack's shared key
+        // at enterprise, nothing otherwise.
+        const taskLogGroupEncryption = tierDefault(props.appBackupTier, "customerManagedKeys")
+            ? { encryptionKey: StackEncryptionKey.of(this).forLogGroups() }
+            : {};
         const backupTaskLogGroup = backupEnabled
             ? new LogGroup(this, "ClickHouseBackupTaskLogGroup", {
-                retention: RetentionDays.TWO_WEEKS
+                retention: RetentionDays.TWO_WEEKS,
+                ...taskLogGroupEncryption
             })
             : undefined;
         // Explicit rather than `logRetention` so the maintenance-status metric
         // filters can attach to it alongside the backup task's group.
         const optimiseTaskLogGroup = optimiseEnabled
             ? new LogGroup(this, "ClickHouseOptimiseTaskLogGroup", {
-                retention: RetentionDays.ONE_WEEK
+                retention: RetentionDays.ONE_WEEK,
+                ...taskLogGroupEncryption
             })
             : undefined;
         // Resolved BEFORE the user data is built: the declared volume size is
@@ -576,6 +589,9 @@ export class ClickHouseDatabase extends Construct {
                 containerInsights: true
             }),
             ...(applicationId !== undefined && { applicationId }),
+            ...(props.appBackupTier !== undefined && {
+                appBackupTier: props.appBackupTier
+            }),
             cluster: {
                 loadBalancer: false,
                 securityGroup,

package/dist/lib/patterns/aws/clickhouseTls/types.d.ts

@@ -17,7 +17,7 @@ export interface ClickHouseSelfSignedTls {
  * supplied the construct surfaces it as a CFN env-var token so consumers
  * can wire it into containers for rotation-triggers-task-replacement
  * parity with self-signed mode. Omit it and rotation requires manual task
- * restart (documented in `aiDocs/patterns/clickhouse-tls-pattern.md § "Imported mode"`).
+ * restart (documented in the ClickHouse TLS pattern, § "Imported mode").
  */
 export interface ClickHouseImportedTls {
     readonly mode: "imported";

package/dist/lib/patterns/aws/compute.js

@@ -164,7 +164,8 @@ export class ComputeFactory {
                 computeProps = {
                     ...computeProps,
                     appName: computeProps.appName ?? app.getName(),
-                    applicationId: computeProps.applicationId ?? app.getName()
+                    applicationId: computeProps.applicationId ?? app.getName(),
+                    appBackupTier: computeProps.appBackupTier ?? app.getBackupTier()
                 };
             }
             // Create specific compute class based on type discriminator
@@ -241,7 +242,8 @@ export class ComputeFactory {
                     // Add appName to props for Lambda (needed for secrets path derivation)
                     const lambdaComputeProps = {
                         ...computeProps,
-                        appName: app.getName()
+                        appName: app.getName(),
+                        appBackupTier: computeProps.appBackupTier ?? app.getBackupTier()
                     };
                     // `ecrRepository` is already defaulted to the app's shared default
                     // container registry above (line ~323) when omitted — the same