@fjall/components-infrastructure 33.0.0 → 34.0.0

package/README.md

@@ -54,84 +54,23 @@ for each of the two secrets.
 
 ## Useful commands
 
-- `npm run build` compile typescript to js
-- `npm run watch` watch for changes and compile
-- `npm run test` perform the jest unit tests
-- `cdk deploy` deploy this stack to your default AWS account/region
-- `cdk diff` compare deployed stack with current state
-- `cdk synth` emits the synthesized CloudFormation template
+- `npm run build` — clean, bundle the Lambda assets and compile TypeScript to `dist/`
+- `npm run watch` — recompile on change
+- `npm test` — run the Vitest suites
+- `npm run typecheck` — type-check the library
 
-## Building patterns
+Synthesis and deployment go through the `fjall` CLI (`fjall deploy`), which
+assembles the stacks from an application's `fjall/` directory. The package is
+not deployed with `cdk deploy` on its own.
 
-Common service patterns are built using a Stack class (i.e AwsStack) and use a builder pattern.
+## Using the constructs
 
-### Referencing VPC
+The constructs are consumed through the `fjall` CLI: `fjall create app` and
+`fjall add <resource>` write the `infrastructure.ts` that composes them, and
+`fjall deploy` synthesises and deploys it. Every construct is also exported
+from the package root for direct use; the reference lives at
+[docs.fjall.io](https://docs.fjall.io).
 
-There are three main ways to reference a VPC
+## Licence
 
-1. In the same stack
-
-When a VPC is created in the same stack resources that rely on it will automatically detect it.
-
-```typescript
-new AwsStack(`${id}App`)
-  .addNetwork(FjallVpc.build(`${id}Vpc`))
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-2. In the same CDK Application but different stack
-
-When a VPC is created in the same application, but you want to use separate stacks, you can directly reference the vpc resource itself. This is easily
-retrieved from an awsStack using `awsStack.getNetwork()`.
-
-```typescript
-const vpcStack = new AwsStack(`${id}Network`).addNetwork(
-  FjallVpc.build(`${id}Vpc`)
-);
-
-const newStack = new AwsStack(`${id}Compute`, { dependencies: [vpcStack] })
-  .addNetwork(vpcStack.getNetwork())
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-3. Different CDK Applications
-
-If your VPC was created in a completely separate CDK Stack it can be imported using it's `id` and `stackName`. However this method
-requires you explicitly configure your `AwsStack` with an `account` and `region.
-
-```typescript
-const env = {
-  region: "us-east-1",
-  account: "123456789012"
-};
-
-const vpcStack = new AwsStack(`${id}Network`, { ...env }).addNetwork(
-  FjallVpc.build(`${id}Vpc`)
-);
-
-const newStack = new AwsStack(`${id}Compute`, {
-  ...env,
-  dependencies: [vpcStack]
-})
-  .addNetwork(FjallVpc.import(`${id}Vpc`, `${id}Network`))
-  .addConstruct(Fargate.build(`${id}Fargate`));
-```
-
-## Publishing package to npm
-
-Log into your NPM account locally (make sure you have 2fa setup before trying this)
-
-```
-npm login
-> Username:
-> Password
-> Email
-> 2Fa
-```
-
-Update the version in ./package.json, build the package and then run publish command
-
-```
-npm run build
-npm publish --access restricted
-```
+Proprietary — see [LICENSE](./LICENSE).

package/dist/lib/app.d.ts

@@ -311,7 +311,7 @@ export declare class App extends CdkApp {
     addDevSubstrate(props: IDevSubstrateProps): DevSubstrate;
     /**
      * Instantiate the self-hosted Buildkite agent fleet on the default compute
-     * stack (design `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`).
+     * stack (design: the 2026-07-18 Buildkite self-hosted agents design).
      *
      * Same placement contract as `addDevSubstrate` above: deploy-core selects
      * stacks by the fixed six-category enum, so scoping under

package/dist/lib/config/aws/identityCentreConfig.d.ts

@@ -4,7 +4,7 @@ import { type DefaultPermissionSetName } from "@fjall/generator";
  * construct. The discriminated union on `source` mirrors AWS ground truth:
  * the identity source of an Identity Center instance is neither readable nor
  * settable via any supported API, so the mode is user-declared and
- * authoritative. Design: aiDocs/designs/2026-07-04-org-user-management-design.md
+ * authoritative. Design: the 2026-07-04 organisation user-management design.
  *
  * The source vocabulary is canonical in @fjall/generator
  * (organisationSchemas.ts) — re-exported here so existing consumers keep

package/dist/lib/config/aws/identityCentreConfig.js

@@ -5,7 +5,7 @@ import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
  * construct. The discriminated union on `source` mirrors AWS ground truth:
  * the identity source of an Identity Center instance is neither readable nor
  * settable via any supported API, so the mode is user-declared and
- * authoritative. Design: aiDocs/designs/2026-07-04-org-user-management-design.md
+ * authoritative. Design: the 2026-07-04 organisation user-management design.
  *
  * The source vocabulary is canonical in @fjall/generator
  * (organisationSchemas.ts) — re-exported here so existing consumers keep

package/dist/lib/config/aws/scpPreset.js

@@ -140,8 +140,7 @@ function buildFoundationGuardrails(allowedRegions) {
                 // assume-root sessions) are deliberately NOT carved out — recovery on
                 // this tier is a break-glass SCP detach, not a standing carve-out. Do
                 // not add them without revisiting the decision:
-                // aiDocs/troubleshooting/centralised-root-access-break-glass-runbook.md
-                // § Scenario 3.
+                // the centralised root-access break-glass runbook, § Scenario 3.
                 NotAction: [
                     "s3:GetBucketPolicy",
                     "s3:PutBucketPolicy",
@@ -347,9 +346,19 @@ function buildCostControls() {
                     "rds:ModifyDBCluster"
                 ],
                 Resource: "*",
+                // A negated operator over an ABSENT key evaluates true, so without
+                // the Null guard this statement denies every RDS request that names
+                // no instance class: a class-less ModifyDBInstance (the destroy
+                // pre-flight's DeletionProtection flip, a retention or parameter-group
+                // change), and Aurora's CreateDBCluster/ModifyDBCluster, where the
+                // class lives on the instances. The guard limits the deny to requests
+                // that carry a class; the instances still gate Aurora, whose Fjall
+                // construct is Serverless v2 only (`db.serverless`).
+                // https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html
                 Condition: {
+                    Null: { "rds:DatabaseClass": "false" },
                     StringNotLike: {
-                        "rds:DatabaseClass": ["db.t3.*", "db.t4g.*"]
+                        "rds:DatabaseClass": ["db.t3.*", "db.t4g.*", "db.serverless"]
                     }
                 }
             }

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -18117,3 +18117,129 @@ exports.handler = async (event) => {
     Data: { CaCertSha256: caCertSha256 }
   };
 };
+/*! Bundled license information:
+
+reflect-metadata/Reflect.js:
+  (*! *****************************************************************************
+  Copyright (C) Microsoft. All rights reserved.
+  Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+  this file except in compliance with the License. You may obtain a copy of the
+  License at http://www.apache.org/licenses/LICENSE-2.0
+  
+  THIS CODE IS PROVIDED ON AN *AS IS* BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, EITHER EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION ANY IMPLIED
+  WARRANTIES OR CONDITIONS OF TITLE, FITNESS FOR A PARTICULAR PURPOSE,
+  MERCHANTABLITY OR NON-INFRINGEMENT.
+  
+  See the Apache Version 2.0 License for specific language governing permissions
+  and limitations under the License.
+  ***************************************************************************** *)
+
+pvtsutils/build/index.js:
+  (*!
+   * MIT License
+   * 
+   * Copyright (c) 2017-2024 Peculiar Ventures, LLC
+   * 
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   * 
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   * 
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   * 
+   *)
+
+pvutils/build/utils.js:
+  (*!
+   Copyright (c) Peculiar Ventures, LLC
+  *)
+
+asn1js/build/index.js:
+  (*!
+   * Copyright (c) 2014, GMO GlobalSign
+   * Copyright (c) 2015-2022, Peculiar Ventures
+   * All rights reserved.
+   * 
+   * Author 2014-2019, Yury Strozhevsky
+   * 
+   * Redistribution and use in source and binary forms, with or without modification,
+   * are permitted provided that the following conditions are met:
+   * 
+   * * Redistributions of source code must retain the above copyright notice, this
+   *   list of conditions and the following disclaimer.
+   * 
+   * * Redistributions in binary form must reproduce the above copyright notice, this
+   *   list of conditions and the following disclaimer in the documentation and/or
+   *   other materials provided with the distribution.
+   * 
+   * * Neither the name of the copyright holder nor the names of its
+   *   contributors may be used to endorse or promote products derived from
+   *   this software without specific prior written permission.
+   * 
+   * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+   * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+   * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+   * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+   * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+   * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+   * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+   * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+   * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+   * 
+   *)
+
+tslib/tslib.es6.js:
+  (*! *****************************************************************************
+  Copyright (c) Microsoft Corporation.
+  
+  Permission to use, copy, modify, and/or distribute this software for any
+  purpose with or without fee is hereby granted.
+  
+  THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+  REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+  AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+  INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+  LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+  OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+  PERFORMANCE OF THIS SOFTWARE.
+  ***************************************************************************** *)
+
+@peculiar/x509/build/x509.cjs.js:
+  (*!
+   * MIT License
+   * 
+   * Copyright (c) Peculiar Ventures. All rights reserved.
+   * 
+   * Permission is hereby granted, free of charge, to any person obtaining a copy
+   * of this software and associated documentation files (the "Software"), to deal
+   * in the Software without restriction, including without limitation the rights
+   * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+   * copies of the Software, and to permit persons to whom the Software is
+   * furnished to do so, subject to the following conditions:
+   * 
+   * The above copyright notice and this permission notice shall be included in all
+   * copies or substantial portions of the Software.
+   * 
+   * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+   * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+   * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   * SOFTWARE.
+   * 
+   *)
+*/

package/dist/lib/patterns/aws/bastionFactory.js

@@ -11,7 +11,8 @@ export function createBastion(networkStack, appName, stackPrefix, vpc, config) {
         serviceName: `${stackPrefix}Bastion`,
         instanceType,
         vpc,
-        enableSSH: false,
+        // Session Manager only: no sshAccess, so no key pair, no port-22 ingress
+        // and private subnets.
         minCapacity: 1,
         maxCapacity: 1
     });

package/dist/lib/patterns/aws/buildkite/buildkite.d.ts

@@ -14,7 +14,7 @@ export type BuildkiteConstructProps = BuildkitePropsInput & {
  * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —
  * scale-to-zero ASG + buildkite-agent-scaler, no secret ever transiting
  * synth, allowlist-only instance IAM. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  *
  * A Construct, not a Stack: instantiate via `App.addBuildkite(props)`, which
  * scopes it under the default compute stack so deploy-core's fixed

package/dist/lib/patterns/aws/buildkite/buildkite.js

@@ -21,7 +21,7 @@ import { buildBuildkiteUserData } from "./userData.js";
  * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —
  * scale-to-zero ASG + buildkite-agent-scaler, no secret ever transiting
  * synth, allowlist-only instance IAM. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  *
  * A Construct, not a Stack: instantiate via `App.addBuildkite(props)`, which
  * scopes it under the default compute stack so deploy-core's fixed

package/dist/lib/patterns/aws/buildkite/factory.d.ts

@@ -5,8 +5,8 @@ import type { BuildkitePropsInput } from "./schema.js";
 /**
  * Thunk returned by `BuildkiteFactory.build` — materialised only by
  * `App.addBuildkite`, which owns stack placement (the fleet has exactly one
- * legal home, `${stackPrefix}Compute`; design
- * `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D2).
+ * legal home, `${stackPrefix}Compute`; design:
+ * the 2026-07-18 `fjall add buildkite` design, § D2).
  */
 export type BuildkiteFactoryFn = (app: App, scope: Construct) => Buildkite;
 /**

package/dist/lib/patterns/aws/buildkite/pins.d.ts

@@ -4,7 +4,7 @@
  * release. AMI ids, the elastic-stack version, the scaler version and the
  * secrets-plugin floor MUST only change together, regenerated from the
  * upstream template for the new version (runbook:
- * `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * the Buildkite stack-bump runbook).
  *
  * AMI ids come from the `Mappings.AWSRegion2AMI` block of
  * `https://s3.amazonaws.com/buildkite-aws-stack/<version>/aws-stack.yml` and
@@ -18,7 +18,7 @@
  * floats the AMI underneath a pinned stack version, needs lookup credentials
  * at synth time (unavailable in worker synth), and makes synth
  * non-deterministic. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md` § D2.
+ * the 2026-07-18 Buildkite self-hosted agents design, § D2.
  */
 export declare const BUILDKITE_AMI_OWNER_ACCOUNT_ID = "172840064832";
 export declare const BUILDKITE_CPU_ARCHITECTURES: readonly ["arm64", "amd64"];

package/dist/lib/patterns/aws/buildkite/pins.js

@@ -4,7 +4,7 @@
  * release. AMI ids, the elastic-stack version, the scaler version and the
  * secrets-plugin floor MUST only change together, regenerated from the
  * upstream template for the new version (runbook:
- * `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * the Buildkite stack-bump runbook).
  *
  * AMI ids come from the `Mappings.AWSRegion2AMI` block of
  * `https://s3.amazonaws.com/buildkite-aws-stack/<version>/aws-stack.yml` and
@@ -18,7 +18,7 @@
  * floats the AMI underneath a pinned stack version, needs lookup credentials
  * at synth time (unavailable in worker synth), and makes synth
  * non-deterministic. Design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md` § D2.
+ * the 2026-07-18 Buildkite self-hosted agents design, § D2.
  */
 export const BUILDKITE_AMI_OWNER_ACCOUNT_ID = "172840064832";
 export const BUILDKITE_CPU_ARCHITECTURES = ["arm64", "amd64"];

package/dist/lib/patterns/aws/buildkite/schema.d.ts

@@ -2,7 +2,7 @@
  * Buildkite props schema — re-export barrel. The canonical declaration lives
  * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
  * validation, the codemod fragment, and the LLM JSON schema all consume one
- * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * source (design: the 2026-07-18 `fjall add buildkite` design, § D4).
  * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
 export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps, type BuildkiteProps, type BuildkitePropsInput, type BuildkitePropsObject } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/schema.js

@@ -2,7 +2,7 @@
  * Buildkite props schema — re-export barrel. The canonical declaration lives
  * in `@fjall/generator` (`src/schemas/buildkiteSchemas.ts`) so construct
  * validation, the codemod fragment, and the LLM JSON schema all consume one
- * source (design `aiDocs/designs/2026-07-18-fjall-add-buildkite.md` § D4).
+ * source (design: the 2026-07-18 `fjall add buildkite` design, § D4).
  * Do NOT redeclare here — the cross-package reference-identity test pins it.
  */
 export { BuildkitePropsObjectSchema, BuildkitePropsSchema, validateBuildkiteProps } from "@fjall/generator";

package/dist/lib/patterns/aws/buildkite/userData.d.ts

@@ -29,7 +29,7 @@ export interface BuildkiteUserDataContext {
  * vendored template in both directions: a key we emit that upstream does not
  * pass is silently ignored; a key upstream passes that we omit is the
  * boot-loop. Bumping the pins regenerates the fixture
- * (runbook: `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * (runbook: the Buildkite stack-bump runbook).
  */
 export declare const BUILDKITE_MOUNT_PART_ENV_KEYS: readonly ["BUILDKITE_ENABLE_INSTANCE_STORAGE", "BUILDKITE_MOUNT_TMPFS_AT_TMP"];
 export declare const BUILDKITE_DOCKER_PART_ENV_KEYS: readonly ["DOCKER_USERNS_REMAP", "DOCKER_EXPERIMENTAL", "DOCKER_PRUNE_UNTIL", "ENABLE_PRE_EXIT_DISK_CLEANUP", "DOCKER_BUILDER_PRUNE_ENABLED", "DOCKER_NETWORKING_PROTOCOL", "DOCKER_IPV4_ADDRESS_POOL_1", "DOCKER_IPV4_ADDRESS_POOL_2", "DOCKER_IPV6_ADDRESS_POOL", "DOCKER_FIXED_CIDR_V4", "DOCKER_FIXED_CIDR_V6", "BUILDKITE_ENABLE_INSTANCE_STORAGE"];

package/dist/lib/patterns/aws/buildkite/userData.js

@@ -10,7 +10,7 @@ import { BUILDKITE_STACK_PINS } from "./pins.js";
  * vendored template in both directions: a key we emit that upstream does not
  * pass is silently ignored; a key upstream passes that we omit is the
  * boot-loop. Bumping the pins regenerates the fixture
- * (runbook: `aiDocs/runbooks/buildkite-stack-bump-runbook.md`).
+ * (runbook: the Buildkite stack-bump runbook).
  */
 export const BUILDKITE_MOUNT_PART_ENV_KEYS = [
     "BUILDKITE_ENABLE_INSTANCE_STORAGE",

package/dist/lib/patterns/aws/buildkite.d.ts

@@ -2,7 +2,7 @@
  * Self-hosted Buildkite agent fleet — barrel for the `buildkite/` modules.
  * The pre-2026-07 `Buildkite extends Stack` implementation is replaced by a
  * Construct instantiated via `App.addBuildkite()`; design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  */
 export { AGENT_TOKEN_SECRET_NAME, BUILDKITE_SECRETS_CLUSTER, Buildkite, FJALL_API_KEY_SECRET_NAME, FJALL_ENV_HOOK_OBJECT_KEY, buildAgentSecretsEnvHookScript, type AgentSecretsEnvHookOptions, type BuildkiteConstructProps } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn, type BuildkiteCpuArchitecture } from "./buildkite/pins.js";

package/dist/lib/patterns/aws/buildkite.js

@@ -2,7 +2,7 @@
  * Self-hosted Buildkite agent fleet — barrel for the `buildkite/` modules.
  * The pre-2026-07 `Buildkite extends Stack` implementation is replaced by a
  * Construct instantiated via `App.addBuildkite()`; design:
- * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ * the 2026-07-18 Buildkite self-hosted agents design.
  */
 export { AGENT_TOKEN_SECRET_NAME, BUILDKITE_SECRETS_CLUSTER, Buildkite, FJALL_API_KEY_SECRET_NAME, FJALL_ENV_HOOK_OBJECT_KEY, buildAgentSecretsEnvHookScript } from "./buildkite/buildkite.js";
 export { BUILDKITE_AMI_OWNER_ACCOUNT_ID, BUILDKITE_CPU_ARCHITECTURES, BUILDKITE_STACK_PINS, resolvePinnedAmiId, resolveScalerSarApplicationArn } from "./buildkite/pins.js";

package/dist/lib/patterns/aws/cdn.d.ts

@@ -87,7 +87,10 @@ interface BaseCdnProps {
      * `cloudFrontLogging` column — enterprise logs to the stack's shared,
      * lifecycle-expired access-log bucket under `cloudfront/<id>/`. Set either
      * knob to take over: `enableLogging: false` opts out at any tier,
-     * `logBucket` delivers to a bucket of your own.
+     * `logBucket` delivers to a bucket of your own. Standard logging cannot
+     * deliver into an opt-in region, so a tier- or explicitly-enabled CDN whose
+     * delivery region is opt-in is refused at synth with those two cures — see
+     * {@link CloudFrontDistributionProps.enableLogging}.
      */
     enableLogging?: boolean;
     logBucket?: IBucket;

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -16,7 +16,6 @@ import { S3Bucket } from "../../resources/aws/storage/s3.js";
 import { Secret } from "../../resources/aws/secrets/secret.js";
 import { LogGroup } from "../../resources/aws/logging/logGroup.js";
 import { StackEncryptionKey } from "../../resources/aws/secrets/stackEncryptionKey.js";
-import { tierDefault } from "../../utils/backupTierMapping.js";
 import { createClickHouseSecurityGroup } from "../../resources/aws/database/clickhouseSecurityGroup.js";
 import { buildMaintenancePreamble, maintenanceOkMarker, maintenanceRun } from "../../resources/aws/database/clickhouseMaintenanceScript.js";
 import { buildClickHouseEntrypointWrapper, buildClickHouseUserData, generateUsersConfigXml } from "../../resources/aws/database/clickhouseUserData.js";
@@ -381,7 +380,10 @@ export class ClickHouseDatabase extends Construct {
         const coldTierBucket = coldTierEnabled
             ? (props.coldTierBucket ??
                 new S3Bucket(this, "ClickHouseColdTierBucket", {
-                    versioned: false
+                    // Tiered table parts, re-tiered from hot storage — versioning would
+                    // only bill for churn; the exemption stamp tells posture so.
+                    versioned: false,
+                    versioningExemption: "cold-tier"
                 }))
             : undefined;
         this.#backupBucket = backupBucket;
@@ -390,9 +392,8 @@ export class ClickHouseDatabase extends Construct {
         // The maintenance-task log groups sit beside the compute's own container
         // and exec-audit groups and follow the same tier: the stack's shared key
         // at enterprise, nothing otherwise.
-        const taskLogGroupEncryption = tierDefault(props.appBackupTier, "customerManagedKeys")
-            ? { encryptionKey: StackEncryptionKey.of(this).forLogGroups() }
-            : {};
+        const stackKey = StackEncryptionKey.forTier(this, props.appBackupTier);
+        const taskLogGroupEncryption = stackKey === undefined ? {} : { encryptionKey: stackKey.forLogGroups() };
         const backupTaskLogGroup = backupEnabled
             ? new LogGroup(this, "ClickHouseBackupTaskLogGroup", {
                 retention: RetentionDays.TWO_WEEKS,

package/dist/lib/patterns/aws/clickhouseTls/types.d.ts

@@ -17,7 +17,7 @@ export interface ClickHouseSelfSignedTls {
  * supplied the construct surfaces it as a CFN env-var token so consumers
  * can wire it into containers for rotation-triggers-task-replacement
  * parity with self-signed mode. Omit it and rotation requires manual task
- * restart (documented in `aiDocs/patterns/clickhouse-tls-pattern.md § "Imported mode"`).
+ * restart (documented in the ClickHouse TLS pattern, § "Imported mode").
  */
 export interface ClickHouseImportedTls {
     readonly mode: "imported";

package/dist/lib/patterns/aws/compute.d.ts

@@ -5,8 +5,8 @@ import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compu
 import type App from "../../app.js";
 import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
 import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
-import { Ec2Compute, type Ec2ComputeProps, type SshConfig } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps, type SshConfig };
+import { Ec2Compute, type Ec2ComputeProps } from "./computeEc2.js";
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/computeEc2.d.ts

@@ -3,31 +3,18 @@ import { type IAutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
 import { Construct } from "constructs";
 import { type IEc2Compute } from "./interfaces/compute.js";
 import { Ec2Instance } from "../../resources/aws/compute/ec2.js";
-/**
- * SSH access configuration for EC2 instances.
- * - Omit: disabled (default)
- * - `{}`: enabled with auto-generated key
- * - `{ keyName: "my-key" }`: enabled with existing key
- * - `false`: explicitly disabled
- */
-export interface SshConfig {
-    /** SSH key pair name */
-    keyName?: string;
-    /** Allowed CIDR blocks for SSH access */
-    allowedCidrs?: string[];
-}
+import { type Ec2SshAccessProps } from "../../resources/aws/compute/ec2SshAccess.js";
 export interface Ec2ComputeProps {
     type: "ec2";
     vpc?: IVpc;
     /** EC2 instance type. Default: "t4g.micro" */
     instanceType?: string;
     /**
-     * SSH access configuration.
-     * - Omit: disabled (default)
-     * - `{}`: enabled with defaults
-     * - `false`: explicitly disabled
+     * SSH access: who may reach port 22 (`allowedIpCidrs`), which key pair
+     * (`keyName`, or omit to mint one) and whether the instances are public
+     * (`public`). Omit for Session Manager-only access, the default.
      */
-    ssh?: SshConfig | false;
+    sshAccess?: Ec2SshAccessProps;
     /** User data script */
     userData?: UserData;
     /** Machine image (AMI) */

package/dist/lib/patterns/aws/computeEc2.js

@@ -1,5 +1,7 @@
 import { Construct } from "constructs";
+import { ec2ServiceName } from "@fjall/util";
 import { Ec2Instance } from "../../resources/aws/compute/ec2.js";
+import { checkRetiredSshProp } from "../../resources/aws/compute/ec2SshAccess.js";
 import { COMPUTE_DEFAULTS } from "./compute.js";
 /**
  * EC2 compute wrapper implementing IEc2Compute.
@@ -11,11 +13,15 @@ export class Ec2Compute extends Construct {
     ec2Instance;
     constructor(scope, id, props) {
         super(scope, id);
-        const enableSSH = props.ssh !== undefined && props.ssh !== false;
+        // The retired `ssh` prop read only its own presence (`keyName` and
+        // `allowedCidrs` were declared and never forwarded); a caller still
+        // passing it gets the translation, or a warning when it asked for the
+        // default.
+        checkRetiredSshProp(this, "Ec2Compute", props);
         const ec2Props = {
-            serviceName: `${id}Service`,
+            serviceName: ec2ServiceName(id),
             instanceType: props.instanceType || COMPUTE_DEFAULTS.EC2.INSTANCE_TYPE,
-            enableSSH,
+            ...(props.sshAccess !== undefined && { sshAccess: props.sshAccess }),
             userData: props.userData,
             machineImage: props.machineImage,
             minCapacity: props.minCapacity || COMPUTE_DEFAULTS.EC2.MIN_CAPACITY,

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -1,6 +1,6 @@
 import { type ICluster, type IBaseService, type TaskDefinition, type FargateTaskDefinition } from "aws-cdk-lib/aws-ecs";
 import { type Connections, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
-import { type IGrantable, type IRole, Grant } from "aws-cdk-lib/aws-iam";
+import { type Grant, type IGrantable, type IRole } from "aws-cdk-lib/aws-iam";
 import { type IApplicationLoadBalancer, type ApplicationListener } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Construct } from "constructs";
 import { type IEcsCompute } from "./interfaces/compute.js";
@@ -264,9 +264,9 @@ export declare class EcsCompute extends Construct implements IEcsCompute {
      */
     getEcsCluster(): EcsCluster;
     /**
-     * Grants ecs:ExecuteCommand permission for ECS services.
-     * Uses wildcard resource because ecs:ExecuteCommand targets task ARNs
-     * which are not known until runtime (tasks are ephemeral).
+     * Grant what an ECS Exec caller needs: `ecs:ExecuteCommand` on this
+     * cluster's tasks and, at a tier that encrypts the session, the
+     * `kms:GenerateDataKey` on the stack key the caller must hold.
      */
     grantExecuteCommand(grantee: IGrantable): Grant;
     /**

package/dist/lib/patterns/aws/computeEcs.js

@@ -1,6 +1,6 @@
 import { AwsLogDriver, ContainerImage, DeploymentLifecycleStage, Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { Peer, Port, SubnetType } from "aws-cdk-lib/aws-ec2";
-import { Effect, Grant, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { Effect, PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { Annotations, Aws, Stack, Token } from "aws-cdk-lib";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
@@ -1688,16 +1688,12 @@ export class EcsCompute extends Construct {
         return this.ecsCluster;
     }
     /**
-     * Grants ecs:ExecuteCommand permission for ECS services.
-     * Uses wildcard resource because ecs:ExecuteCommand targets task ARNs
-     * which are not known until runtime (tasks are ephemeral).
+     * Grant what an ECS Exec caller needs: `ecs:ExecuteCommand` on this
+     * cluster's tasks and, at a tier that encrypts the session, the
+     * `kms:GenerateDataKey` on the stack key the caller must hold.
      */
     grantExecuteCommand(grantee) {
-        return Grant.addToPrincipal({
-            grantee,
-            actions: ["ecs:ExecuteCommand"],
-            resourceArns: ["*"]
-        });
+        return this.ecsCluster.grantExecuteCommand(grantee);
     }
     /**
      * Get the EC2 instance role for the cluster's underlying ASG. EC2-mode