@fjall/components-infrastructure 32.0.0 → 33.1.0

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -171,6 +171,13 @@ export declare class EcsCompute extends Construct implements IEcsCompute {
      * the version entry the app containers get.
      */
     private resolveSchemaGateMaterialisation;
+    /**
+     * Encryption for a log group this pattern creates beside the cluster's
+     * own (scheduled-task and migration-task logs): the stack's shared key
+     * when the app backup tier encrypts, nothing otherwise — the same key the
+     * cluster resolved for its service and exec-audit groups.
+     */
+    private tierLogGroupEncryption;
     private materialiseScheduledTasks;
     private buildScheduledTaskDefinition;
     /**

package/dist/lib/patterns/aws/computeEcs.js

@@ -955,6 +955,12 @@ export class EcsCompute extends Construct {
                 domainConfig: props.cluster.domainConfig,
                 ...(props.cluster.securityGroup !== undefined && {
                     securityGroup: props.cluster.securityGroup
+                }),
+                ...(props.cluster.loadBalancerDeletionProtection !== undefined && {
+                    loadBalancerDeletionProtection: props.cluster.loadBalancerDeletionProtection
+                }),
+                ...(props.cluster.loadBalancerAccessLogs !== undefined && {
+                    loadBalancerAccessLogs: props.cluster.loadBalancerAccessLogs
                 })
             }
             : undefined;
@@ -970,7 +976,12 @@ export class EcsCompute extends Construct {
             applicationId: props.applicationId ??
                 (App.hasInstance() ? App.getInstance().getName() : undefined),
             ...(props.taskStopWatchdog === false && { taskStopWatchdog: false }),
-            ...(props.containerInsights === true && { containerInsights: true })
+            ...(props.containerInsights !== undefined && {
+                containerInsights: props.containerInsights
+            }),
+            ...(props.appBackupTier !== undefined && {
+                appBackupTier: props.appBackupTier
+            })
         };
         this.ecsCluster = new EcsCluster(this, `${id}Ecs`, ecsProps);
         this.connections = this.ecsCluster.connections;
@@ -1155,6 +1166,16 @@ export class EcsCompute extends Construct {
             defaultImageTag: CONSTRUCTS_VERSION
         };
     }
+    /**
+     * Encryption for a log group this pattern creates beside the cluster's
+     * own (scheduled-task and migration-task logs): the stack's shared key
+     * when the app backup tier encrypts, nothing otherwise — the same key the
+     * cluster resolved for its service and exec-audit groups.
+     */
+    tierLogGroupEncryption() {
+        const key = this.ecsCluster.encryptionKey;
+        return key === undefined ? {} : { encryptionKey: key.forLogGroups() };
+    }
     materialiseScheduledTasks(id, props) {
         const scheduledTasks = props.cluster?.scheduledTasks;
         if (!scheduledTasks || scheduledTasks.length === 0)
@@ -1200,7 +1221,8 @@ export class EcsCompute extends Construct {
         // removal default (D17).
         const logGroup = entry.logGroup ??
             new LogGroup(this, `${id}${toPascalCase(entry.name)}LogGroup`, {
-                retention: entry.logRetention ?? DEFAULT_LOG_RETENTION
+                retention: entry.logRetention ?? DEFAULT_LOG_RETENTION,
+                ...this.tierLogGroupEncryption()
             });
         const logging = new AwsLogDriver({
             streamPrefix: `/ecs-scheduled/${id}/${entry.name}`,
@@ -1429,7 +1451,8 @@ export class EcsCompute extends Construct {
         const inheritedImage = service.taskDefinition.defaultContainer?.imageName;
         const image = resolveMigrationImage(svcConfig, migrations, inheritedImage);
         const logGroup = new LogGroup(this, `${idPrefix}LogGroup`, {
-            retention: RetentionDays.ONE_MONTH
+            retention: RetentionDays.ONE_MONTH,
+            ...this.tierLogGroupEncryption()
         });
         const executionRole = new Role(this, `${idPrefix}ExecutionRole`, {
             assumedBy: new ServicePrincipal("ecs-tasks.amazonaws.com")

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -5,6 +5,7 @@ import { type ILogGroup, type RetentionDays } from "aws-cdk-lib/aws-logs";
 import { type PolicyDocument, type IManagedPolicy, type PolicyStatement } from "aws-cdk-lib/aws-iam";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type ConnectionSpec } from "./interfaces/connector.js";
+import type { BackupTier } from "../../utils/backupTierMapping.js";
 import { type RemoteConnectionSpec } from "../../resources/aws/compute/ecsRemoteConnections.js";
 import { type EcsRoutingConfig, type EcsContainerDependency } from "../../resources/aws/compute/ecsTypes.js";
 import { ScalingType, type DomainConfig, type EcsCapacityProvider, type Ec2CapacityConfig, type QueueScalingConfig } from "../../resources/aws/compute/ecs.js";
@@ -181,8 +182,8 @@ export interface EcsContainerConfig {
  *   per service. Suitable for high-replica services where the init-container
  *   tax dominates rollout time.
  *
- * @see aiDocs/decisions/2026-04-29-ecs-init-container-over-runtask.md
- * @see aiDocs/plans/2026-04-29-ecs-factory-hardening.md § 4.3.4 — threshold
+ * @see the 2026-04-29 decision: ECS init container over RunTask
+ * @see the 2026-04-29 ECS factory-hardening plan, § 4.3.4 — threshold
  *   guidance for choosing between modes.
  * @see https://aws.amazon.com/blogs/containers/announcing-amazon-ecs-deployment-lifecycle-hooks/
  */
@@ -222,7 +223,7 @@ export type EcsMigrationsMode = "init-container" | "lifecycle-hook" | "post-depl
  *   mode: "lifecycle-hook"
  * }
  *
- * @see aiDocs/decisions/2026-04-29-ecs-init-container-over-runtask.md
+ * @see the 2026-04-29 decision: ECS init container over RunTask
  */
 /**
  * Discriminated on `mode`. The init-container variant keeps its narrow surface
@@ -236,8 +237,8 @@ export type EcsMigrationsMode = "init-container" | "lifecycle-hook" | "post-depl
  * lifecycle-hook-only field — is a typecheck error. This protects against
  * the Pitfall-5 trap (silent field drift across union variants).
  *
- * @see aiDocs/designs/2026-05-12-migration-runner-abstraction-choice.md
- * @see .claude/rules/typescript-standards.md § "Pitfall 5"
+ * @see the 2026-05-12 migration-runner abstraction-choice design
+ * @see the TypeScript standards, Zod Pitfall 5 (three-way option drift)
  */
 export type EcsMigrationsConfig = EcsInitContainerMigrationsConfig | EcsLifecycleHookMigrationsConfig | EcsPostDeployMigrationsConfig;
 /**
@@ -623,6 +624,19 @@ export interface EcsClusterConfig {
      * (e.g. ClickHouseDatabase) that own their security group lifecycle.
      */
     securityGroup?: ISecurityGroup;
+    /**
+     * Deletion protection on the shared load balancer. Default: the app backup
+     * tier's `deletionProtection` column, applied only when the stack's
+     * environment resolves to production. The destroy pre-flight switches it
+     * off before a consented destroy.
+     */
+    loadBalancerDeletionProtection?: boolean;
+    /**
+     * Access logs from the shared load balancer into the stack's
+     * lifecycle-expired access-log bucket. Default: the app backup tier's
+     * `albAccessLogs` column.
+     */
+    loadBalancerAccessLogs?: boolean;
     /**
      * Scheduled tasks materialised into `Ec2TaskDefinition`s and registered via
      * `app.addSchedule(...)` against the existing `EcsScheduleTarget` shape
@@ -1074,9 +1088,18 @@ export interface EcsComputeProps {
      * `RunningTaskCount` liveness alarms (`ecsAlarms.ts` gates them on this
      * flag because the metric only exists in `ECS/ContainerInsights`).
      * Scale-to-zero services should pair it with
-     * `alarms: { runningTasksMinimum: 0 }` or they idle in ALARM.
+     * `alarms: { runningTasksMinimum: 0 }` or they idle in ALARM. Default:
+     * the app backup tier's `containerInsights` column (on at enterprise);
+     * `false` is an explicit, auditable opt-out.
      */
-    containerInsights?: true;
+    containerInsights?: boolean;
     /** Application ID for alarm tagging (used by webhook to map alarms to applications). */
     applicationId?: string;
+    /**
+     * The owning app's backup tier. Auto-derived from the App by
+     * ComputeFactory; the tier-owned defaults (Container Insights, exec-session
+     * and log-group encryption, load-balancer deletion protection and access
+     * logs) follow it. Only specify for direct construction.
+     */
+    appBackupTier?: BackupTier;
 }

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -4,6 +4,7 @@ import { Connections, type IVpc, type ISecurityGroup } from "aws-cdk-lib/aws-ec2
 import { Repository } from "aws-cdk-lib/aws-ecr";
 import { type RepositoryImage } from "aws-cdk-lib/aws-ecs";
 import { Construct } from "constructs";
+import type { BackupTier } from "../../utils/backupTierMapping.js";
 import { type ILambdaCompute } from "./interfaces/compute.js";
 import { type ConnectionSpec } from "./interfaces/connector.js";
 import { LambdaFunction } from "../../resources/aws/compute/lambda.js";
@@ -95,6 +96,17 @@ interface BaseLambdaProps {
      * Only specify for advanced use cases.
      */
     appName?: string;
+    /**
+     * The owning app's backup tier. Auto-derived from the App by
+     * ComputeFactory; the tier-owned defaults (X-Ray tracing, environment and
+     * log-group encryption) follow it. Only specify for direct construction.
+     */
+    appBackupTier?: BackupTier;
+    /**
+     * Active X-Ray tracing. Default: the app backup tier's `lambdaTracing`
+     * column (on at enterprise).
+     */
+    tracing?: boolean;
     /**
      * Resources this Lambda needs to connect to (e.g., databases, S3 buckets, SQS queues).
      * Creates security group rules for IConnectable resources and IAM grants for IAM resources.

package/dist/lib/patterns/aws/computeLambda.js

@@ -167,6 +167,8 @@ export class LambdaCompute extends Construct {
             secretsImport: props.secretsImport,
             environment: props.environment,
             appName: props.appName,
+            appBackupTier: props.appBackupTier,
+            tracing: props.tracing,
             functionName: id
         };
         this.lambdaFunction = new LambdaFunction(scope, `${id}Lambda`, lambdaProps);

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -10,6 +10,8 @@ const COMPUTE_PROP_APPLICABILITY = {
     type: "all",
     vpc: "all",
     appName: ["ecs", "lambda"],
+    appBackupTier: ["ecs", "lambda"],
+    tracing: ["lambda"],
     docker: ["ecs", "lambda"],
     ecrRepository: ["ecs", "lambda"],
     cluster: ["ecs"],

package/dist/lib/patterns/aws/database.d.ts

@@ -5,6 +5,7 @@ import type { RdsAlarmThresholds } from "../../resources/aws/monitoring/index.js
 import type App from "../../app.js";
 import { type DynamoDBKeySchema, type DynamoDBGlobalSecondaryIndex } from "../../resources/aws/database/dynamodb.js";
 import { ClickHouseDatabase, type ClickHouseDatabaseProps, type ClickHouseAlarmThresholds } from "./clickhouseDatabase.js";
+import { type BackupTier } from "../../utils/backupTierMapping.js";
 import { type Connections, type IConnectable, type IVpc } from "aws-cdk-lib/aws-ec2";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
 import { type Secret, type SecretImport } from "../../resources/aws/secrets/index.js";
@@ -40,6 +41,13 @@ type BaseDatabaseProps = {
     databaseName: string;
     instanceType?: string;
     deletionProtection?: boolean;
+    /**
+     * The owning app's backup tier (`App.getApp({ backup: { tier } })`), which
+     * the tier-owned defaults (backup retention) follow. `DatabaseFactory`
+     * fills it from the App as it does `vpc` and `applicationId`; pass it only
+     * for direct `new RelationalDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
     /** SNS topic for alarm notifications. Accepts ITopic, ARN string, or "import:ExportName". */
     alertsTopic?: ITopic | string;
     /** Alarm thresholds. false to disable, undefined for defaults, object to override. */
@@ -194,6 +202,12 @@ export interface DynamoDBDatabaseProps {
     encryption?: "AWS_OWNED" | "AWS_MANAGED" | "CUSTOMER_MANAGED";
     deletionProtection?: boolean;
     removalPolicy?: "DESTROY" | "RETAIN" | "SNAPSHOT";
+    /**
+     * The owning app's backup tier, which the tier-owned defaults (encryption,
+     * deletion protection) follow. `DatabaseFactory` fills it from the App;
+     * pass it only for direct `new DynamoDBDatabase(...)` construction.
+     */
+    appBackupTier?: BackupTier;
 }
 /**
  * Relational database props union (Aurora, Instance, GlobalAurora).

package/dist/lib/patterns/aws/database.js

@@ -130,7 +130,7 @@ function validateRelationalDatabaseProps(props) {
     // Instance-only options on Aurora/GlobalAurora
     warnIfPropertiesIgnored(props, ["readReplica", "multiAz", "allocatedStorage", "iamAuthentication"], "Instance", "Instance database");
     // Aurora-only options on Instance
-    warnIfPropertiesIgnored(props, ["readers", "writer", "backupRetention"], ["Aurora", "GlobalAurora"], "Aurora database");
+    warnIfPropertiesIgnored(props, ["readers", "writer"], ["Aurora", "GlobalAurora"], "Aurora database");
     // GlobalAurora-only options on non-global databases
     warnIfPropertiesIgnored(props, ["primaryRegion", "secondaryRegions", "enableGlobalWriteForwarding"], "GlobalAurora", "GlobalAurora database");
 }
@@ -170,21 +170,27 @@ export class DatabaseFactory {
     static build(id, props) {
         return (app, scope) => {
             if (props.type === "DynamoDB") {
-                validateDatabaseProps(props);
-                return new DynamoDBDatabase(scope, id, props);
+                const dynamoProps = {
+                    ...props,
+                    appBackupTier: props.appBackupTier ?? app.getBackupTier()
+                };
+                validateDatabaseProps(dynamoProps);
+                return new DynamoDBDatabase(scope, id, dynamoProps);
             }
             if (props.type === "ClickHouse") {
                 const clickhouseProps = {
                     ...props,
                     vpc: props.vpc ?? app.getVpc(),
-                    applicationId: props.applicationId ?? app.getName()
+                    applicationId: props.applicationId ?? app.getName(),
+                    appBackupTier: props.appBackupTier ?? app.getBackupTier()
                 };
                 return new ClickHouseDatabase(scope, id, clickhouseProps);
             }
             const databaseProps = {
                 ...props,
                 vpc: props.vpc ?? app.getVpc(),
-                applicationId: props.applicationId ?? app.getName()
+                applicationId: props.applicationId ?? app.getName(),
+                appBackupTier: props.appBackupTier ?? app.getBackupTier()
             };
             validateDatabaseProps(databaseProps);
             return new RelationalDatabase(scope, id, databaseProps);
@@ -223,7 +229,8 @@ export class DynamoDBDatabase extends Construct {
             pointInTimeRecovery: props.pointInTimeRecovery,
             encryption: props.encryption,
             deletionProtection: props.deletionProtection,
-            removalPolicy: props.removalPolicy
+            removalPolicy: props.removalPolicy,
+            appBackupTier: props.appBackupTier
         };
         this.table = new DynamoDBTable(this, id, tableProps);
     }
@@ -390,6 +397,7 @@ export class RelationalDatabase extends Construct {
             credentials: props.credentials,
             encryption: props.encryption,
             backupRetention: props.backupRetention,
+            appBackupTier: props.appBackupTier,
             monitoringInterval: props.monitoringInterval,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow,
             port: props.port,
@@ -429,6 +437,7 @@ export class RelationalDatabase extends Construct {
             credentials: props.credentials,
             encryption: props.encryption,
             backupRetention: props.backupRetention,
+            appBackupTier: props.appBackupTier,
             monitoringInterval: props.monitoringInterval,
             preferredMaintenanceWindow: props.preferredMaintenanceWindow,
             port: props.port,
@@ -459,6 +468,7 @@ export class RelationalDatabase extends Construct {
             backupRetention: props.backupRetention !== undefined
                 ? Duration.days(props.backupRetention)
                 : undefined,
+            appBackupTier: props.appBackupTier,
             databaseInsights: props.databaseInsights,
             proxy: props.proxy,
             readReplica: props.readReplica,

package/dist/lib/patterns/aws/interfaces/pattern.d.ts

@@ -468,16 +468,16 @@ export interface StaticSiteCdnConfig {
  * optional contact-form endpoint (Lambda Function URL → SES, CloudFront-fronted).
  *
  * @example
- * app.addPattern(PatternFactory.build("LbexcSite", {
+ * app.addPattern(PatternFactory.build("StorefrontSite", {
  *   type: "staticsite",
- *   name: "lbexc",
- *   source: "../../lbexc-static-export",
+ *   name: "storefront",
+ *   source: "../../storefront-static-export",
  *   build: { command: "npm run build", outputDir: "out" },
  *   routing: "multipage",
  *   security: { headers: true },
- *   domain: "lbexc.com",
- *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
- *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
+ *   domain: "storefront.example",
+ *   zoneName: "storefront.example", // or a CLI-injected `managedDomain` binding
+ *   forms: { to: "hello@storefront.example", corsOrigin: "https://storefront.example" }
  * }));
  */
 export interface IStaticSiteProps {

package/dist/lib/patterns/aws/messaging.js

@@ -315,7 +315,10 @@ export class MessagingFactory {
                         applicationId: props.applicationId ?? app.getName()
                     });
                 case "topic":
-                    return new TopicMessaging(scope, id, props);
+                    return new TopicMessaging(scope, id, {
+                        ...props,
+                        appBackupTier: props.appBackupTier ?? app.getBackupTier()
+                    });
                 case "eventBus":
                     return new EventBusMessaging(scope, id, props);
                 default: {

package/dist/lib/patterns/aws/patternDomain.d.ts

@@ -7,7 +7,7 @@
  *
  * - Nothing here guesses a hosted zone. The old `extractRootDomain` label
  *   split resolved every multi-label public suffix wrongly (e.g.
- *   'littlebearearthworks.com.au' → zone 'com.au') and mis-placed delegated
+ *   'example.com.au' → zone 'com.au') and mis-placed delegated
  *   sub-zone records; it is deleted. Zone identity now arrives explicitly, in
  *   priority order: a CLI-injected {@link ManagedDomainBinding} (literal
  *   values — crosses accounts and regions), the legacy

package/dist/lib/patterns/aws/patternDomain.js

@@ -7,7 +7,7 @@
  *
  * - Nothing here guesses a hosted zone. The old `extractRootDomain` label
  *   split resolved every multi-label public suffix wrongly (e.g.
- *   'littlebearearthworks.com.au' → zone 'com.au') and mis-placed delegated
+ *   'example.com.au' → zone 'com.au') and mis-placed delegated
  *   sub-zone records; it is deleted. Zone identity now arrives explicitly, in
  *   priority order: a CLI-injected {@link ManagedDomainBinding} (literal
  *   values — crosses accounts and regions), the legacy

package/dist/lib/patterns/aws/payload.js

@@ -41,8 +41,6 @@ const PAYLOAD_DEFAULTS = {
     SOURCE: "../..",
     DATABASE: {
         TYPE: "Instance",
-        /** AWS default; 7 days covers most accidental data loss recovery scenarios */
-        BACKUP_RETENTION: 7,
         DELETION_PROTECTION: true
     },
     COMPUTE: {
@@ -172,7 +170,7 @@ export class Payload extends Construct {
         return {
             databaseName: dbConfig.databaseName ?? toValidDatabaseName(this.props.name),
             databaseEngine: dbConfig.databaseEngine ?? "postgresql",
-            backupRetention: dbConfig.backupRetention ?? PAYLOAD_DEFAULTS.DATABASE.BACKUP_RETENTION,
+            backupRetention: dbConfig.backupRetention,
             deletionProtection: dbConfig.deletionProtection ??
                 PAYLOAD_DEFAULTS.DATABASE.DELETION_PROTECTION,
             publiclyAccessible: dbConfig.publiclyAccessible,
@@ -219,8 +217,10 @@ export class Payload extends Construct {
     createAssetsBucket() {
         const assetsConfig = this.props.storage?.assets ?? {};
         const assetsProps = {
-            // Build output, pruned on every deploy — versioning would only bill for churn.
+            // Build output, pruned on every deploy — versioning would only bill for
+            // churn; the exemption stamp tells posture the omission is by design.
             versioned: assetsConfig.versioned ?? false,
+            versioningExemption: "build-output",
             deployment: {
                 source: `${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.ASSETS}`,
                 prune: true,
@@ -235,8 +235,10 @@ export class Payload extends Construct {
     createCacheBucket() {
         const cacheConfig = this.props.storage?.cache ?? {};
         const cacheProps = {
-            // ISR cache, regenerated at runtime — versioning would only bill for churn.
+            // ISR cache, regenerated at runtime — versioning would only bill for
+            // churn; the exemption stamp tells posture the omission is by design.
             versioned: cacheConfig.versioned ?? false,
+            versioningExemption: "isr-cache",
             deployment: {
                 source: `${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.CACHE}`,
                 prune: false // ISR adds files at runtime

package/dist/lib/patterns/aws/staticSite.d.ts

@@ -13,16 +13,16 @@
  * - Contact-form Lambda + Function URL (when `forms` is set)
  *
  * @example
- * const site = app.addPattern(PatternFactory.build("LbexcSite", {
+ * const site = app.addPattern(PatternFactory.build("StorefrontSite", {
  *   type: "staticsite",
- *   name: "lbexc",
- *   source: "../../lbexc-static-export",
+ *   name: "storefront",
+ *   source: "../../storefront-static-export",
  *   build: { command: "npm run build", outputDir: "out" },
  *   routing: "multipage",
  *   security: { headers: true },
- *   domain: "lbexc.com",
- *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
- *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
+ *   domain: "storefront.example",
+ *   zoneName: "storefront.example", // or a CLI-injected `managedDomain` binding
+ *   forms: { to: "hello@storefront.example", corsOrigin: "https://storefront.example" }
  * }));
  */
 import { Construct } from "constructs";

package/dist/lib/patterns/aws/staticSite.js

@@ -13,16 +13,16 @@
  * - Contact-form Lambda + Function URL (when `forms` is set)
  *
  * @example
- * const site = app.addPattern(PatternFactory.build("LbexcSite", {
+ * const site = app.addPattern(PatternFactory.build("StorefrontSite", {
  *   type: "staticsite",
- *   name: "lbexc",
- *   source: "../../lbexc-static-export",
+ *   name: "storefront",
+ *   source: "../../storefront-static-export",
  *   build: { command: "npm run build", outputDir: "out" },
  *   routing: "multipage",
  *   security: { headers: true },
- *   domain: "lbexc.com",
- *   zoneName: "lbexc.com", // or a CLI-injected `managedDomain` binding
- *   forms: { to: "hello@lbexc.com", corsOrigin: "https://lbexc.com" }
+ *   domain: "storefront.example",
+ *   zoneName: "storefront.example", // or a CLI-injected `managedDomain` binding
+ *   forms: { to: "hello@storefront.example", corsOrigin: "https://storefront.example" }
  * }));
  */
 import { Construct } from "constructs";
@@ -207,6 +207,9 @@ export class StaticSite extends Construct {
             reservedConcurrentExecutions: forms.maxConcurrency ?? FORMS_DEFAULTS.MAX_CONCURRENCY,
             lambdaDescription: `Contact-form handler for ${this.props.name}`,
             roleDescription: `Contact-form send role for ${this.props.name}`,
+            // An app workload, not a framework handler: tracing and encryption
+            // follow the app backup tier like every factory-built Lambda.
+            appBackupTier: this.app.getBackupTier(),
             enableFunctionUrl: true,
             functionUrlAuthType: FunctionUrlAuthType.NONE,
             functionUrlCors: {

package/dist/lib/patterns/aws/storage.d.ts

@@ -2,6 +2,7 @@ import { Construct } from "constructs";
 import { type EventType, type IBucketNotificationDestination, type NotificationKeyFilter } from "aws-cdk-lib/aws-s3";
 import { type IDistribution } from "aws-cdk-lib/aws-cloudfront";
 import { type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
+import { type S3VersioningExemption } from "@fjall/util/aws";
 import type App from "../../app.js";
 import { BucketDeployment, S3Bucket, type ResourcePolicyStatement, type WebsiteHostingConfig } from "../../resources/aws/storage/index.js";
 import { type BackupTier } from "../../utils/backupTierMapping.js";
@@ -39,6 +40,13 @@ export interface S3Props {
      * `resilient`/`enterprise`, off otherwise. An explicit value always wins.
      */
     readonly versioned?: boolean;
+    /**
+     * Why this bucket runs unversioned by design (`build-output`, `isr-cache`,
+     * `cold-tier`) — see `S3BucketProps.versioningExemption`. Stamped as the
+     * `fjall:s3:versioning-exempt` tag when versioning resolves off; a bucket
+     * that versions after all is not stamped.
+     */
+    readonly versioningExemption?: S3VersioningExemption;
     readonly encryption?: "AES256" | "KMS";
     readonly kmsKeyArn?: string;
     /**

package/dist/lib/patterns/aws/storage.js

@@ -78,6 +78,7 @@ export class Storage extends Construct {
             aliasTargetName: props.bucketName ?? id,
             appName: props.appName,
             versioned: props.versioned,
+            versioningExemption: props.versioningExemption,
             encryption: toBucketEncryption(props.encryption),
             encryptionKey,
             ...(props.bucketKeyEnabled !== undefined && {

package/dist/lib/resources/aws/cdn/cloudFront.d.ts

@@ -60,6 +60,8 @@ export interface CloudFrontDistributionProps {
     comment?: string;
     enableLogging?: boolean;
     logBucket?: IBucket;
+    /** Key prefix for standard logs delivered to `logBucket`. */
+    logFilePrefix?: string;
     priceClass?: CloudFrontPriceClass;
     /** Adds a CloudFront Function to copy the viewer Host header into X-Forwarded-Host.
      * Required when the origin is a Lambda Function URL or ALB behind CloudFront,

package/dist/lib/resources/aws/cdn/cloudFront.js

@@ -110,6 +110,7 @@ export class CloudFrontDistribution extends Construct {
             comment: props.comment,
             enableLogging: props.enableLogging,
             logBucket: props.logBucket,
+            logFilePrefix: props.logFilePrefix,
             priceClass: this.resolvePriceClass(props.priceClass)
         });
         // The CDN-qualified export is unconditional and always unique, so an app

package/dist/lib/resources/aws/cdn/responseHeadersPolicy.d.ts

@@ -40,7 +40,7 @@ export interface SecurityHeadersPolicyProps {
  * Wrapped on the description + SOC2-defaults trigger (NOT taggability — the
  * resource is not taggable): it owns Fjall's uniform security-header defaults
  * so every consumer inherits the same posture in one edit. Per
- * `.claude/rules/generator-standards.md § Wrapper Routing Discipline`,
+ * the Wrapper Routing Discipline rule (generator standards),
  * `lib/{config,patterns}/` instantiate this class, never the raw L2.
  *
  * Defaults (all `override:true`): HSTS 730d+includeSubdomains+preload,

package/dist/lib/resources/aws/cdn/responseHeadersPolicy.js

@@ -18,7 +18,7 @@ const DEFAULT_COMMENT = "Fjall security headers policy";
  * Wrapped on the description + SOC2-defaults trigger (NOT taggability — the
  * resource is not taggable): it owns Fjall's uniform security-header defaults
  * so every consumer inherits the same posture in one edit. Per
- * `.claude/rules/generator-standards.md § Wrapper Routing Discipline`,
+ * the Wrapper Routing Discipline rule (generator standards),
  * `lib/{config,patterns}/` instantiate this class, never the raw L2.
  *
  * Defaults (all `override:true`): HSTS 730d+includeSubdomains+preload,

package/dist/lib/resources/aws/compute/applicationLoadBalancer.d.ts

@@ -7,6 +7,16 @@ export interface ApplicationLoadBalancerOptions {
     readonly internetFacing: boolean;
     readonly loadBalancerName?: string;
     readonly securityGroup?: ISecurityGroup;
+    /**
+     * `deletion_protection.enabled` on the load balancer (CDK emits the
+     * attribute as `false` when unset, so an unprotected template is unchanged).
+     */
+    readonly deletionProtection?: boolean;
+    /**
+     * Deliver access logs to the stack's shared access-log bucket under
+     * `alb/<id>/`. The bucket is created on first use.
+     */
+    readonly accessLogs?: boolean;
 }
 /**
  * Context-free Application Load Balancer factory shared by the ECS cluster path

package/dist/lib/resources/aws/compute/applicationLoadBalancer.js

@@ -2,6 +2,7 @@ import { Duration } from "aws-cdk-lib";
 import { ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { SubnetType } from "aws-cdk-lib/aws-ec2";
 import { DEFAULT_ALB_IDLE_TIMEOUT_SECONDS } from "@fjall/util/httpKeepAlive";
+import { stackAccessLogBucket } from "../logging/accessLogBucket.js";
 /**
  * Context-free Application Load Balancer factory shared by the ECS cluster path
  * and the dev substrate. Subnet placement is derived from `internetFacing`
@@ -9,7 +10,7 @@ import { DEFAULT_ALB_IDLE_TIMEOUT_SECONDS } from "@fjall/util/httpKeepAlive";
  * ECS path's existing derivation so the extraction is byte-identical.
  */
 export function createApplicationLoadBalancer(scope, id, options) {
-    return new ApplicationLoadBalancer(scope, id, {
+    const loadBalancer = new ApplicationLoadBalancer(scope, id, {
         vpc: options.vpc,
         internetFacing: options.internetFacing,
         // Pinned (rather than left at the AWS default of the same value) because
@@ -23,10 +24,15 @@ export function createApplicationLoadBalancer(scope, id, options) {
         ...(options.loadBalancerName && {
             loadBalancerName: options.loadBalancerName
         }),
+        deletionProtection: options.deletionProtection,
         vpcSubnets: {
             subnetType: options.internetFacing
                 ? SubnetType.PUBLIC
                 : SubnetType.PRIVATE_WITH_EGRESS
         }
     });
+    if (options.accessLogs === true) {
+        loadBalancer.logAccessLogs(stackAccessLogBucket(scope), `alb/${id}`);
+    }
+    return loadBalancer;
 }

package/dist/lib/resources/aws/compute/ec2.d.ts

@@ -27,7 +27,7 @@ export type Ec2InstancePersistentDataVolumeConfig = Omit<PersistentDataVolumePro
  *   `AutoScalingScheduledAction.IgnoreUnmodifiedGroupSizeProperties`
  *   regardless. For callers owning rollout externally.
  *
- * See `aiDocs/troubleshooting/clickhouse-rolling-update-window.md` for the
+ * See the ClickHouse rolling-update-window troubleshooting note for the
  * ClickHouse-specific downtime expectations.
  */
 export type Ec2InstanceUpdatePolicyConfig = {
@@ -127,7 +127,7 @@ export interface Ec2InstanceProps extends StackProps {
      * ASG `UpdatePolicy` resolution. Absent → `UpdatePolicy.instanceRefresh`
      * (0/100 with `persistentDataVolume`, 100/200 otherwise). See
      * `Ec2InstanceUpdatePolicyConfig` for the variant menu and
-     * `aiDocs/troubleshooting/clickhouse-rolling-update-window.md` for the
+     * the ClickHouse rolling-update-window troubleshooting note for the
      * downtime-window runbook.
      */
     updatePolicy?: Ec2InstanceUpdatePolicyConfig;

package/dist/lib/resources/aws/compute/ec2.js

@@ -17,7 +17,7 @@ import { PersistentDataVolume } from "./persistentDataVolume.js";
  * `encrypted: true` enforces EBS encryption at the wrapper layer rather than
  * relying on the AWS account-level "encryption by default" setting — the
  * propagation contract documented in
- * `.claude/rules/generator-standards.md § "Wrapper Routing Discipline"`.
+ * the Wrapper Routing Discipline rule (generator standards).
  */
 const DEFAULT_ROOT_DEVICE_NAME = "/dev/xvda";
 const DEFAULT_ROOT_VOLUME_SIZE_GIB = 30;