@fjall/components-infrastructure 34.0.0 → 35.0.0

package/dist/lib/app.js

@@ -12,6 +12,7 @@ import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDis
 import { BuildkiteFactory } from "./patterns/aws/buildkite.js";
 import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
+import { DeployTimeWriterMarkerAspect } from "./utils/deployTimeWriterMarkerAspect.js";
 import { emitAppLevelAlbAliasExports } from "./utils/albAliasTargetRegistry.js";
 import { emitAppLevelCdnAliasExports } from "./utils/cdnAliasTargetRegistry.js";
 import { ensureFunctionLogGroups } from "./resources/aws/logging/logGroupHygiene.js";
@@ -61,6 +62,7 @@ export class App extends CdkApp {
             context: { [RDS_PREVENT_RENDERING_DEPRECATED_CREDENTIALS]: true }
         });
         App.instance = this;
+        Aspects.of(this).add(new DeployTimeWriterMarkerAspect());
         this.name = name ?? "FjallApp";
         this.stackPrefix = toPascalCase(this.name);
         // Initialise manifest collector for build-time service discovery

package/dist/lib/config/aws/deployBoundarySingleton.d.ts

@@ -102,6 +102,12 @@ export declare const SECURITY_TIER_DIGESTS: {
  * Five is IAM's per-policy version ceiling: at five, the oldest non-default
  * version is dropped before the new default is published.
  * `GetPolicyVersion` returns the document URL-encoded, hence the decode.
+ *
+ * TODO 2026-09-05, owner: paul — tag on adopt (a `TagPolicy` after the live
+ * read when the marker is absent, so an ADOPTED policy carries the marker the
+ * create path applies via `Tags: props.PolicyTags`); blocked on the
+ * inline-code budget, tracked in the deploy-boundary raises decisions design
+ * note (2026-09-05, § 6 "Train 8").
  */
 export declare const DEPLOY_BOUNDARY_HANDLER_CORE: string;
 /**

package/dist/lib/config/aws/deployBoundarySingleton.js

@@ -1,4 +1,4 @@
-import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName } from "@fjall/generator";
+import { SECURITY_TIER_TO_BOUNDARY, deployBoundaryName, deployBoundaryPolicyArn } from "@fjall/generator";
 import { Aws, Duration } from "aws-cdk-lib";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { Runtime } from "aws-cdk-lib/aws-lambda";
@@ -147,6 +147,12 @@ const ALLOWED_DIGEST_LITERALS = Object.values(SECURITY_TIER_DIGESTS)
  * Five is IAM's per-policy version ceiling: at five, the oldest non-default
  * version is dropped before the new default is published.
  * `GetPolicyVersion` returns the document URL-encoded, hence the decode.
+ *
+ * TODO 2026-09-05, owner: paul — tag on adopt (a `TagPolicy` after the live
+ * read when the marker is absent, so an ADOPTED policy carries the marker the
+ * create path applies via `Tags: props.PolicyTags`); blocked on the
+ * inline-code budget, tracked in the deploy-boundary raises decisions design
+ * note (2026-09-05, § 6 "Train 8").
  */
 export const DEPLOY_BOUNDARY_HANDLER_CORE = `const { IAMClient, GetPolicyCommand, GetPolicyVersionCommand, CreatePolicyCommand, CreatePolicyVersionCommand, ListPolicyVersionsCommand, DeletePolicyVersionCommand } = require('@aws-sdk/client-iam');
 const { createHash } = require('crypto');
@@ -225,7 +231,9 @@ export class DeployBoundarySingleton extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.policyName = deployBoundaryName(props.fjallOrgId);
-        const policyArn = `arn:${Aws.PARTITION}:iam::${Aws.ACCOUNT_ID}:policy/${this.policyName}`;
+        // Same SSoT builder the seam-2 probe and the destroy sweep address the
+        // policy with — three renderers, one derivation.
+        const policyArn = deployBoundaryPolicyArn(Aws.PARTITION, Aws.ACCOUNT_ID, props.fjallOrgId);
         const writer = new CustomResource(this, "Policy", {
             runtime: Runtime.NODEJS_24_X,
             timeout: Duration.seconds(DEPLOY_BOUNDARY_WRITER_TIMEOUT_SECONDS),

package/dist/lib/config/aws/identityCenter.js

@@ -5,6 +5,7 @@ import { Annotations, CfnOutput, NestedStack } from "aws-cdk-lib";
 import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
 import { Group, GroupMembership, PermissionSet, Assignment, IdentityStoreUser, IdentityStoreUserProvider, identityStoreUserArnPattern } from "../../resources/aws/iam/identityCenter/index.js";
 import { ManagedPolicy, Role } from "../../resources/aws/iam/index.js";
+import { markDeployTimeWriter } from "../../utils/resourceTypeTags.js";
 import { allGroupNames, assignmentConstructId, boundGroupsForSet, effectivePermissionSets, implicitGroupNames, resolveTargetAccountNames, validateIdentityCentreConfig } from "./identityCentreConfig.js";
 // CreateAccountAssignment has a 15-outstanding-async limit. Batching at 8
 // keeps headroom for CFN's internal retries within the same backoff window.
@@ -74,6 +75,7 @@ export class IdentityCenter extends NestedStack {
                 })
             }
         });
+        markDeployTimeWriter(this.listInstancesRole);
     }
     listIdentityCenterInstance() {
         const listInstancesCall = {

package/dist/lib/resources/aws/compute/lambda.d.ts

@@ -109,6 +109,11 @@ export interface LambdaFunctionProps {
 /**
  * Framework custom-resource handlers are tier-agnostic: the tier-owned
  * knobs are excluded at the type rather than silently ignored.
+ *
+ * Every singleton in this library backs a custom-resource provider, which is
+ * why the constructor marks the hoisted subtree as a deploy-time writer. A
+ * singleton fronting a runtime lambda would need that call moved to the two
+ * writer call sites (`utilities/customResource.ts`, `iam/identityCenter/user.ts`).
  */
 export interface SingletonFunctionProps extends Omit<LambdaFunctionProps, "tracing" | "appBackupTier"> {
     uuid?: string;

package/dist/lib/resources/aws/compute/lambda.js

@@ -18,6 +18,7 @@ import { resolveImportedSecret } from "../secrets/index.js";
 import { validateSsmPathComponent } from "./ecsValidation.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { resolvePrivateSubnetType } from "../../../utils/vpcUtils.js";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 import { createLambdaAlarms } from "../monitoring/index.js";
 function addPoliciesToRole(target, statements) {
     for (const statement of statements) {
@@ -155,6 +156,13 @@ export class SingletonFunction extends singletonFunction {
         addPoliciesToRole(this, props.inlinePolicy);
         applyRoleDescription(this, props.roleDescription);
         applyRolePathAndName(this, props.rolePath, props.roleName);
+        // aws-cdk-lib hoists the singleton's Function — and with it the execution
+        // role — to the stack scope, so a tag applied to this construct or to the
+        // enclosing writer never reaches either. Found the way CDK's own
+        // `ensureLambda` finds it, by the public `constructName`; `findChild`
+        // throws if the hoist ever moves, so a CDK upgrade fails at synth rather
+        // than shipping an unmarked role.
+        markDeployTimeWriter(Stack.of(this).node.findChild(this.constructName));
     }
     /**
      * The Lambda's execution role (auto-generated by CDK)

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -7,6 +7,7 @@ import { Provider } from "aws-cdk-lib/custom-resources";
 import { Construct } from "constructs";
 import { SingletonFunction } from "../../compute/lambda.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../../logging/logGroup.js";
+import { markDeployTimeWriter } from "../../../../utils/resourceTypeTags.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Resolves relative to the compiled location too — the build step copies the
@@ -58,6 +59,7 @@ export class IdentityStoreUserProvider extends Construct {
             })
         });
         this.serviceToken = provider.serviceToken;
+        markDeployTimeWriter(this);
     }
 }
 /**

package/dist/lib/resources/aws/networking/vpcPeeringAccepterRole.js

@@ -1,7 +1,8 @@
 import { Construct } from "constructs";
-import { ArnFormat, Stack, Tags } from "aws-cdk-lib";
+import { ArnFormat, Stack } from "aws-cdk-lib";
 import { AccountPrincipal, CompositePrincipal, PolicyDocument, PolicyStatement, Role } from "aws-cdk-lib/aws-iam";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
+import { applyResourceTypeTag, FJALL_RESOURCE_TYPES } from "../../../utils/resourceTypeTags.js";
 export class VpcPeeringAccepterRole extends Construct {
     role;
     roleArn;
@@ -53,7 +54,7 @@ export class VpcPeeringAccepterRole extends Construct {
             }
         });
         this.roleArn = this.role.roleArn;
-        Tags.of(this).add("fjall:resource:type", "vpc-peering-accepter");
+        applyResourceTypeTag(this, FJALL_RESOURCE_TYPES.vpcPeeringAccepter);
         applyCostAllocationTags(this, {
             service: "vpcPeeringAccepter",
             domain: props.costAllocationDomain ?? props.localVpc.node.id,

package/dist/lib/resources/aws/networking/vpcPeeringConnection.js

@@ -4,6 +4,7 @@ import { CfnRoute, CfnVPCPeeringConnection, SubnetType } from "aws-cdk-lib/aws-e
 import { PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { AwsCustomResourcePolicy, PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { applyCostAllocationTags } from "../../../utils/costAllocationTags.js";
+import { applyResourceTypeTag, FJALL_RESOURCE_TYPES } from "../../../utils/resourceTypeTags.js";
 import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { CrossAccountReturnRoutes } from "./crossAccountReturnRoutes.js";
 export class VpcPeeringConnection extends Construct {
@@ -92,7 +93,7 @@ export class VpcPeeringConnection extends Construct {
                 enableDns: enableDnsResolution
             });
         }
-        Tags.of(this).add("fjall:resource:type", "vpc-peering");
+        applyResourceTypeTag(this, FJALL_RESOURCE_TYPES.vpcPeering);
         Tags.of(this).add("fjall:peering:peer-vpc", props.peerVpcId);
         if (props.peerAccountId) {
             Tags.of(this).add("fjall:peering:peer-account", props.peerAccountId);

package/dist/lib/resources/aws/storage/bucketDeployment.d.ts

@@ -8,6 +8,11 @@ import { type Construct } from "constructs";
  * service-auto-created. Per the Wrapper Routing Discipline rule (generator
  * standards) and the infrastructure wrapper-routing pattern (§ A3), `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
+ *
+ * The handler is a deploy-time writer: aws-cdk-lib hoists its function and
+ * execution role to the stack scope under an id that embeds a per-variant
+ * uuid (memory, VPC, ephemeral storage), so the role is marked through the
+ * public `handlerRole` seam rather than by construct id.
  */
 export declare class BucketDeployment extends CdkBucketDeployment {
     constructor(scope: Construct, id: string, props: BucketDeploymentProps);

package/dist/lib/resources/aws/storage/bucketDeployment.js

@@ -1,4 +1,5 @@
 import { BucketDeployment as CdkBucketDeployment } from "aws-cdk-lib/aws-s3-deployment";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
 /**
  * Routing-point wrapper for `aws-cdk-lib/aws-s3-deployment.BucketDeployment`.
@@ -8,6 +9,11 @@ import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
  * service-auto-created. Per the Wrapper Routing Discipline rule (generator
  * standards) and the infrastructure wrapper-routing pattern (§ A3), `lib/{config,
  * patterns}/` MUST instantiate this class rather than the raw CDK construct.
+ *
+ * The handler is a deploy-time writer: aws-cdk-lib hoists its function and
+ * execution role to the stack scope under an id that embeds a per-variant
+ * uuid (memory, VPC, ephemeral storage), so the role is marked through the
+ * public `handlerRole` seam rather than by construct id.
  */
 export class BucketDeployment extends CdkBucketDeployment {
     constructor(scope, id, props) {
@@ -19,5 +25,6 @@ export class BucketDeployment extends CdkBucketDeployment {
             // site instantiates first.
             logGroup: props.logGroup ?? stackSingletonLogGroup(scope, "BucketDeployment")
         });
+        markDeployTimeWriter(this.handlerRole);
     }
 }

package/dist/lib/resources/aws/utilities/awsCustomResource.d.ts

@@ -1,5 +1,14 @@
 import * as customResource from "aws-cdk-lib/custom-resources";
 import { type Construct } from "constructs";
+/**
+ * The stack-scope construct id under which aws-cdk-lib hoists the one
+ * `AwsCustomResource` provider every site in a stack shares: the singleton's
+ * `lambdaPurpose` ("AWS") followed by its uuid with the hyphens stripped —
+ * `SingletonFunction.constructName`'s derivation, from the public
+ * `PROVIDER_FUNCTION_UUID`. Test fixtures address the hoisted function and
+ * its execution role by this prefix.
+ */
+export declare const AWS_CUSTOM_RESOURCE_PROVIDER_ID: string;
 export declare class AwsCustomResource extends customResource.AwsCustomResource {
     readonly response: string;
     constructor(scope: Construct, id: string, props: customResource.AwsCustomResourceProps);

package/dist/lib/resources/aws/utilities/awsCustomResource.js

@@ -1,5 +1,16 @@
+import { Stack } from "aws-cdk-lib";
 import * as customResource from "aws-cdk-lib/custom-resources";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 import { stackSingletonLogGroup } from "../logging/singletonLogGroup.js";
+/**
+ * The stack-scope construct id under which aws-cdk-lib hoists the one
+ * `AwsCustomResource` provider every site in a stack shares: the singleton's
+ * `lambdaPurpose` ("AWS") followed by its uuid with the hyphens stripped —
+ * `SingletonFunction.constructName`'s derivation, from the public
+ * `PROVIDER_FUNCTION_UUID`. Test fixtures address the hoisted function and
+ * its execution role by this prefix.
+ */
+export const AWS_CUSTOM_RESOURCE_PROVIDER_ID = `AWS${customResource.AwsCustomResource.PROVIDER_FUNCTION_UUID.replace(/[^a-zA-Z0-9]/g, "")}`;
 export class AwsCustomResource extends customResource.AwsCustomResource {
     response;
     constructor(scope, id, props) {
@@ -14,5 +25,10 @@ export class AwsCustomResource extends customResource.AwsCustomResource {
                     resources: customResource.AwsCustomResourcePolicy.ANY_RESOURCE
                 })
         });
+        // aws-cdk-lib hoists the shared provider — and, unless the site passed
+        // `role`, its execution role — to the stack scope, out of reach of any
+        // tag on this construct. `findChild` throws if the hoist ever moves, so a
+        // CDK upgrade that would silently un-mark the role fails at synth.
+        markDeployTimeWriter(Stack.of(this).node.findChild(AWS_CUSTOM_RESOURCE_PROVIDER_ID));
     }
 }

package/dist/lib/resources/aws/utilities/customResource.js

@@ -5,6 +5,7 @@ import { Construct } from "constructs";
 import { SingletonFunction, LambdaFunction } from "../compute/lambda.js";
 import { DEFAULT_CUSTOM_RESOURCE_TIMEOUT_SECONDS } from "../compute/ecsConstants.js";
 import { DEFAULT_FRAMEWORK_LOG_RETENTION, LogGroup } from "../logging/logGroup.js";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
 export class CustomResource extends Construct {
     response;
     resource;
@@ -71,5 +72,6 @@ export class CustomResource extends Construct {
             })
         });
         this.response = this.resource.getAtt("Response").toString();
+        markDeployTimeWriter(this);
     }
 }

package/dist/lib/resources/aws/utilities/customResourceProvider.d.ts

@@ -1,5 +1,11 @@
 import { Provider, type ProviderProps } from "aws-cdk-lib/custom-resources";
 import { type Construct } from "constructs";
+/**
+ * Routing-point wrapper for the custom-resource provider framework. The
+ * framework's onEvent/isComplete functions and their roles are deploy-time
+ * writers; the caller's own handler (`props.onEventHandler`) lives outside
+ * this scope and is the caller's to mark.
+ */
 export declare class CustomResourceProvider extends Provider {
     constructor(scope: Construct, id: string, props: ProviderProps);
 }

package/dist/lib/resources/aws/utilities/customResourceProvider.js

@@ -1,6 +1,14 @@
 import { Provider } from "aws-cdk-lib/custom-resources";
+import { markDeployTimeWriter } from "../../../utils/resourceTypeTags.js";
+/**
+ * Routing-point wrapper for the custom-resource provider framework. The
+ * framework's onEvent/isComplete functions and their roles are deploy-time
+ * writers; the caller's own handler (`props.onEventHandler`) lives outside
+ * this scope and is the caller's to mark.
+ */
 export class CustomResourceProvider extends Provider {
     constructor(scope, id, props) {
         super(scope, id, props);
+        markDeployTimeWriter(this);
     }
 }

package/dist/lib/utils/deployTimeWriterMarkerAspect.d.ts

@@ -0,0 +1,23 @@
+import { type IAspect } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+/**
+ * Marks the execution roles aws-cdk-lib's lightweight custom-resource
+ * provider framework (`CustomResourceProviderBase`) renders as raw
+ * `AWS::IAM::Role` CfnResources: `Custom::VpcRestrictDefaultSG` under the
+ * `@aws-cdk/aws-ec2:restrictDefaultSecurityGroup` flag every scaffolded
+ * `cdk.json` sets, `Custom::CrossAccountZoneDelegation`, and whichever the
+ * next CDK release adds. Those roles have no tag manager, so `Tags.of()` —
+ * the wrappers' mechanism — never reaches them; this aspect writes the marker
+ * as a property override instead. Registered once per `App`, so every stack
+ * gets it without a per-construct site to forget.
+ *
+ * Recognised structurally, not by construct id: a `Role` CfnResource whose
+ * parent exposes the framework's `serviceToken` + `roleArn` pair. Prototype
+ * probing rather than `instanceof`, for the duplicate-aws-cdk-lib reason
+ * `logGroupHygiene` records. The full `Provider` framework exposes no
+ * `roleArn` and builds L2 roles, so it is not matched here — its wrappers tag
+ * it directly.
+ */
+export declare class DeployTimeWriterMarkerAspect implements IAspect {
+    visit(node: IConstruct): void;
+}

package/dist/lib/utils/deployTimeWriterMarkerAspect.js

@@ -0,0 +1,35 @@
+import { CfnResource } from "aws-cdk-lib";
+import { markDeployTimeWriterCfn } from "./resourceTypeTags.js";
+/**
+ * Marks the execution roles aws-cdk-lib's lightweight custom-resource
+ * provider framework (`CustomResourceProviderBase`) renders as raw
+ * `AWS::IAM::Role` CfnResources: `Custom::VpcRestrictDefaultSG` under the
+ * `@aws-cdk/aws-ec2:restrictDefaultSecurityGroup` flag every scaffolded
+ * `cdk.json` sets, `Custom::CrossAccountZoneDelegation`, and whichever the
+ * next CDK release adds. Those roles have no tag manager, so `Tags.of()` —
+ * the wrappers' mechanism — never reaches them; this aspect writes the marker
+ * as a property override instead. Registered once per `App`, so every stack
+ * gets it without a per-construct site to forget.
+ *
+ * Recognised structurally, not by construct id: a `Role` CfnResource whose
+ * parent exposes the framework's `serviceToken` + `roleArn` pair. Prototype
+ * probing rather than `instanceof`, for the duplicate-aws-cdk-lib reason
+ * `logGroupHygiene` records. The full `Provider` framework exposes no
+ * `roleArn` and builds L2 roles, so it is not matched here — its wrappers tag
+ * it directly.
+ */
+export class DeployTimeWriterMarkerAspect {
+    visit(node) {
+        if (!CfnResource.isCfnResource(node) ||
+            node.cfnResourceType !== "AWS::IAM::Role") {
+            return;
+        }
+        const parent = node.node.scope;
+        if (parent === undefined || !isLightweightProvider(parent))
+            return;
+        markDeployTimeWriterCfn(node);
+    }
+}
+function isLightweightProvider(construct) {
+    return "serviceToken" in construct && "roleArn" in construct;
+}

package/dist/lib/utils/resourceTypeTags.d.ts

@@ -0,0 +1,41 @@
+import { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType } from "@fjall/util/aws";
+import { type CfnResource } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType };
+/**
+ * Stamp the `fjall:resource:type` marker on a construct subtree. The marker
+ * answers "what IS this resource" for resources whose physical name is
+ * CloudFormation-generated, so a consumer never has to pattern-match a name.
+ */
+export declare function applyResourceTypeTag(scope: IConstruct, resourceType: FjallResourceType): void;
+/**
+ * Mark a deploy-time-only writer subtree — the execution role CloudFormation
+ * assumes while driving a custom resource, plus the handler, the provider
+ * framework function and their log groups.
+ *
+ * Every writer producer in the library routes through one of two mechanisms,
+ * nothing stamping the key by hand:
+ *
+ * - this helper, called by each wrapper that constructs a writer: the shared
+ *   `CustomResource` utility and the `CustomResourceProvider` wrapper (their
+ *   own subtree), the `SingletonFunction`, `AwsCustomResource` and
+ *   `BucketDeployment` wrappers (the function and role aws-cdk-lib hoists to
+ *   the stack scope, out of reach of any tag on the wrapper itself), the
+ *   identity-store user provider, and the Identity Centre ListInstances role;
+ * - `DeployTimeWriterMarkerAspect` (registered by `App`), for the execution
+ *   roles aws-cdk-lib's lightweight provider framework renders as raw
+ *   CfnResources — `Tags.of()` cannot reach those, so the marker goes on as a
+ *   property override via `markDeployTimeWriterCfn`.
+ *
+ * The producer set is enumerated from source by
+ * `__tests__/deployTimeWriterCensus.test.ts`: a new construction of a CDK
+ * writer class fails that test until it names the mechanism that marks it.
+ */
+export declare function markDeployTimeWriter(scope: IConstruct): void;
+/**
+ * The raw-CfnResource twin of `markDeployTimeWriter`, for a role the
+ * lightweight `CustomResourceProviderBase` framework renders without a tag
+ * manager: the marker is written straight into the resource's `Tags`
+ * property. Called only by `DeployTimeWriterMarkerAspect`.
+ */
+export declare function markDeployTimeWriterCfn(role: CfnResource): void;

package/dist/lib/utils/resourceTypeTags.js

@@ -0,0 +1,54 @@
+import { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES } from "@fjall/util/aws";
+import { Tags } from "aws-cdk-lib";
+// Canonical home: @fjall/util (`util/src/aws/infraTags.ts`) — shared with the
+// Quick-Create template's hand-written twin and the webapp posture exclusion.
+// Re-exported here so construct-package consumers keep one import path.
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES };
+/**
+ * Stamp the `fjall:resource:type` marker on a construct subtree. The marker
+ * answers "what IS this resource" for resources whose physical name is
+ * CloudFormation-generated, so a consumer never has to pattern-match a name.
+ */
+export function applyResourceTypeTag(scope, resourceType) {
+    Tags.of(scope).add(FJALL_RESOURCE_TYPE_TAG_KEY, resourceType);
+}
+/**
+ * Mark a deploy-time-only writer subtree — the execution role CloudFormation
+ * assumes while driving a custom resource, plus the handler, the provider
+ * framework function and their log groups.
+ *
+ * Every writer producer in the library routes through one of two mechanisms,
+ * nothing stamping the key by hand:
+ *
+ * - this helper, called by each wrapper that constructs a writer: the shared
+ *   `CustomResource` utility and the `CustomResourceProvider` wrapper (their
+ *   own subtree), the `SingletonFunction`, `AwsCustomResource` and
+ *   `BucketDeployment` wrappers (the function and role aws-cdk-lib hoists to
+ *   the stack scope, out of reach of any tag on the wrapper itself), the
+ *   identity-store user provider, and the Identity Centre ListInstances role;
+ * - `DeployTimeWriterMarkerAspect` (registered by `App`), for the execution
+ *   roles aws-cdk-lib's lightweight provider framework renders as raw
+ *   CfnResources — `Tags.of()` cannot reach those, so the marker goes on as a
+ *   property override via `markDeployTimeWriterCfn`.
+ *
+ * The producer set is enumerated from source by
+ * `__tests__/deployTimeWriterCensus.test.ts`: a new construction of a CDK
+ * writer class fails that test until it names the mechanism that marks it.
+ */
+export function markDeployTimeWriter(scope) {
+    applyResourceTypeTag(scope, FJALL_RESOURCE_TYPES.deployTimeWriter);
+}
+/**
+ * The raw-CfnResource twin of `markDeployTimeWriter`, for a role the
+ * lightweight `CustomResourceProviderBase` framework renders without a tag
+ * manager: the marker is written straight into the resource's `Tags`
+ * property. Called only by `DeployTimeWriterMarkerAspect`.
+ */
+export function markDeployTimeWriterCfn(role) {
+    role.addPropertyOverride("Tags", [
+        {
+            Key: FJALL_RESOURCE_TYPE_TAG_KEY,
+            Value: FJALL_RESOURCE_TYPES.deployTimeWriter
+        }
+    ]);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "34.0.0",
+  "version": "35.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^34.0.0",
-    "@fjall/util": "^34.0.0",
+    "@fjall/generator": "^35.0.0",
+    "@fjall/util": "^35.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },