@fjall/components-infrastructure 37.0.0 → 39.0.0

package/dist/lib/utils/exportNaming.d.ts

@@ -1,35 +1,38 @@
 import type { Construct } from "constructs";
 /**
- * Qualify a CloudFormation export name with the stack that emits it.
+ * Construct-side adapter for the stack-qualified export names whose contract
+ * is `@fjall/util`'s `stackExportNames` module.
  *
- * Export names are unique per account per region, so a name built only from a
- * construct id or a cluster name is shared by every app that happens to use
- * the same id — and the ids inside a pattern are literals the app author never
- * chooses. Two apps then collide, and the second one fails at CloudFormation
- * execution ("Export with name X is already exported by stack Y") after its
- * first resources exist, so it rolls back rather than refusing up front.
+ * Export names are unique per account per region, so a name built only from
+ * a construct id or a cluster name is shared by every app that happens to use
+ * the same id — and the ids inside a pattern are literals the app author
+ * never chooses. Two apps then collide, and the second one fails at
+ * CloudFormation execution ("Export with name X is already exported by stack
+ * Y") after its first resources exist, so it rolls back rather than refusing
+ * up front. Stack names are already unique per account+region and Fjall
+ * derives them from the app name, so qualifying with the stack makes the
+ * export unique AND puts the app name in it.
  *
- * Stack names are already unique per account+region (CloudFormation enforces
- * it) and Fjall derives them from the app name, so prefixing with the stack
- * name makes the export globally unique AND puts the app name in it.
+ * `@fjall/util` owns the composition — `stackScopedExportName` and the
+ * builders on top of it (`deployableServiceExportName`,
+ * `deployableClusterExportName`, `clusterArnExportName`,
+ * `vpcCidrExportName`) — so the runtime consumers that read an export back
+ * (deploy-core's `EcsServiceResolver`, the fjall.io webapp's VPC CIDR
+ * capture) rebuild the exact name through the same function the construct
+ * emitted it with. This helper only supplies the stack: a construct passes
+ * itself and the suffix is qualified with the stack it lives in. An export a
+ * consumer rebuilds by whole name goes through its specific builder with
+ * `Stack.of(this).stackName`, never through this generic form.
  *
- * The suffix must stay last. Consumers match these by suffix and by app-name
- * token, never by whole string — `EcsServiceResolver` filters on
- * `endsWith("deployableservice")` (deploy-core
- * services/infrastructure/EcsServiceResolver.ts) and the webapp finds a linked
- * app's CIDR by `ListExports` + a `-vpc-cidr` suffix filter
- * (webapp app/.server/services/infrastructure/captureVpcCidr.ts). Prefixing is
- * transparent to both; changing the tail is not.
- *
- * NOT for exports a consumer reconstructs by whole name. Those are contracts
- * with their own vocabulary module and must keep their exact spelling:
- * `getDomainExportNames` (@fjall/util), `EXPORT_NAMES`
- * (patterns/aws/targets/targetResolution.ts), `SHARED_ALARM_TOPIC_EXPORT_NAME`,
- * the CloudTrail output keys, and `${toPascalCase(appName)}EcrRepositoryName`
- * (read by `resolveEcrRepositoryName` in the CLI). Account-level singletons
- * (`AccountId`, `Environment`, `OrganisationId`, `FjallAuditRoleArn`, …) also
- * keep their bare names: exactly one is meant to exist, so a collision there
- * correctly reports a duplicate deployment.
+ * NOT for exports a consumer reconstructs from its own vocabulary module.
+ * Those keep their exact spelling: `getDomainExportNames` (@fjall/util),
+ * `EXPORT_NAMES` (patterns/aws/targets/targetResolution.ts),
+ * `SHARED_ALARM_TOPIC_EXPORT_NAME`, the CloudTrail output keys, and
+ * `${toPascalCase(appName)}EcrRepositoryName` (read by
+ * `resolveEcrRepositoryName` in the CLI). Account-level singletons
+ * (`AccountId`, `Environment`, `OrganisationId`, `FjallAuditRoleArn`, …)
+ * also keep their bare names: exactly one is meant to exist, so a collision
+ * there correctly reports a duplicate deployment.
  */
 export declare function stackScopedExportName(scope: Construct, suffix: string): string;
 /**

package/dist/lib/utils/exportNaming.js

@@ -1,38 +1,42 @@
 import { Stack } from "aws-cdk-lib";
+import { stackScopedExportName as qualifyWithStack } from "@fjall/util";
 /**
- * Qualify a CloudFormation export name with the stack that emits it.
+ * Construct-side adapter for the stack-qualified export names whose contract
+ * is `@fjall/util`'s `stackExportNames` module.
  *
- * Export names are unique per account per region, so a name built only from a
- * construct id or a cluster name is shared by every app that happens to use
- * the same id — and the ids inside a pattern are literals the app author never
- * chooses. Two apps then collide, and the second one fails at CloudFormation
- * execution ("Export with name X is already exported by stack Y") after its
- * first resources exist, so it rolls back rather than refusing up front.
+ * Export names are unique per account per region, so a name built only from
+ * a construct id or a cluster name is shared by every app that happens to use
+ * the same id — and the ids inside a pattern are literals the app author
+ * never chooses. Two apps then collide, and the second one fails at
+ * CloudFormation execution ("Export with name X is already exported by stack
+ * Y") after its first resources exist, so it rolls back rather than refusing
+ * up front. Stack names are already unique per account+region and Fjall
+ * derives them from the app name, so qualifying with the stack makes the
+ * export unique AND puts the app name in it.
  *
- * Stack names are already unique per account+region (CloudFormation enforces
- * it) and Fjall derives them from the app name, so prefixing with the stack
- * name makes the export globally unique AND puts the app name in it.
+ * `@fjall/util` owns the composition — `stackScopedExportName` and the
+ * builders on top of it (`deployableServiceExportName`,
+ * `deployableClusterExportName`, `clusterArnExportName`,
+ * `vpcCidrExportName`) — so the runtime consumers that read an export back
+ * (deploy-core's `EcsServiceResolver`, the fjall.io webapp's VPC CIDR
+ * capture) rebuild the exact name through the same function the construct
+ * emitted it with. This helper only supplies the stack: a construct passes
+ * itself and the suffix is qualified with the stack it lives in. An export a
+ * consumer rebuilds by whole name goes through its specific builder with
+ * `Stack.of(this).stackName`, never through this generic form.
  *
- * The suffix must stay last. Consumers match these by suffix and by app-name
- * token, never by whole string — `EcsServiceResolver` filters on
- * `endsWith("deployableservice")` (deploy-core
- * services/infrastructure/EcsServiceResolver.ts) and the webapp finds a linked
- * app's CIDR by `ListExports` + a `-vpc-cidr` suffix filter
- * (webapp app/.server/services/infrastructure/captureVpcCidr.ts). Prefixing is
- * transparent to both; changing the tail is not.
- *
- * NOT for exports a consumer reconstructs by whole name. Those are contracts
- * with their own vocabulary module and must keep their exact spelling:
- * `getDomainExportNames` (@fjall/util), `EXPORT_NAMES`
- * (patterns/aws/targets/targetResolution.ts), `SHARED_ALARM_TOPIC_EXPORT_NAME`,
- * the CloudTrail output keys, and `${toPascalCase(appName)}EcrRepositoryName`
- * (read by `resolveEcrRepositoryName` in the CLI). Account-level singletons
- * (`AccountId`, `Environment`, `OrganisationId`, `FjallAuditRoleArn`, …) also
- * keep their bare names: exactly one is meant to exist, so a collision there
- * correctly reports a duplicate deployment.
+ * NOT for exports a consumer reconstructs from its own vocabulary module.
+ * Those keep their exact spelling: `getDomainExportNames` (@fjall/util),
+ * `EXPORT_NAMES` (patterns/aws/targets/targetResolution.ts),
+ * `SHARED_ALARM_TOPIC_EXPORT_NAME`, the CloudTrail output keys, and
+ * `${toPascalCase(appName)}EcrRepositoryName` (read by
+ * `resolveEcrRepositoryName` in the CLI). Account-level singletons
+ * (`AccountId`, `Environment`, `OrganisationId`, `FjallAuditRoleArn`, …)
+ * also keep their bare names: exactly one is meant to exist, so a collision
+ * there correctly reports a duplicate deployment.
  */
 export function stackScopedExportName(scope, suffix) {
-    return `${Stack.of(scope).stackName}${suffix}`;
+    return qualifyWithStack(Stack.of(scope).stackName, suffix);
 }
 /**
  * Export name for the account's IPAM private default scope.

package/dist/lib/utils/standardTagsAspect.d.ts

@@ -5,12 +5,19 @@ import { type IConstruct } from "constructs";
  *
  * This aspect handles tags that depend on resource-specific properties:
  * - fjall:operations:pool on VPCs with IPAM configuration
- * - fjall:disasterRecovery:tier on S3 buckets with backup configuration
  *
  * Standard Fjall tags (costAllocation:environment, costAllocation:service, etc.)
  * are applied via Tags.of(app).add() in the App class, which properly merges
  * with existing tags from L2 constructs.
  *
+ * The disaster-recovery tier tag is NOT applied here. It is stamped at
+ * construction by the five constructs that own a backup-eligible resource
+ * (`tagBackupTier`), because an aspect can only reach the resource by walking
+ * up the scope chain — which cannot tell an Aurora cluster from its member
+ * instances, or a primary from its read replica — and because `Tags.of(...)`
+ * called inside `visit()` is an aspect adding an aspect, dropped silently when
+ * `aspectStabilization` is off.
+ *
  * This aspect uses Tags.of(node).add() to properly merge with existing tags
  */
 export declare class StandardTagsAspect implements IAspect {
@@ -21,21 +28,4 @@ export declare class StandardTagsAspect implements IAspect {
      * Tag format: fjall:operations:pool = "{accountId}-{region}"
      */
     private addIpamPoolTag;
-    /**
-     * Add the disaster recovery tier tag to S3 buckets from the bucket's
-     * effective tier — the per-bucket `backupVaultTier` override, else the
-     * app-level tier the factory threaded in. CDK child tags override parent
-     * tags, so an override wins over the app-level tag set via
-     * `App.getApp({ backup })`; an inherited app tier writes the value that tag
-     * already carries. The same resolution decides the bucket's versioning
-     * default (`S3Bucket`).
-     *
-     * Tag format: fjall:disasterRecovery:tier = "{tier}"
-     *
-     * Tier mapping:
-     * - standard -> "default" (matches existing backup plans)
-     * - resilient -> "resilient"
-     * - enterprise -> "enterprise"
-     */
-    private addBackupTierTag;
 }

package/dist/lib/utils/standardTagsAspect.js

@@ -1,17 +1,23 @@
 import { CfnResource, Stack, Tags } from "aws-cdk-lib";
-import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./backupTierMapping.js";
 import { formatIpamPairTagValue, IPAM_OPERATIONS_POOL_TAG_KEY } from "@fjall/util/aws";
 /**
  * Aspect to apply special Fjall tags to specific resource types.
  *
  * This aspect handles tags that depend on resource-specific properties:
  * - fjall:operations:pool on VPCs with IPAM configuration
- * - fjall:disasterRecovery:tier on S3 buckets with backup configuration
  *
  * Standard Fjall tags (costAllocation:environment, costAllocation:service, etc.)
  * are applied via Tags.of(app).add() in the App class, which properly merges
  * with existing tags from L2 constructs.
  *
+ * The disaster-recovery tier tag is NOT applied here. It is stamped at
+ * construction by the five constructs that own a backup-eligible resource
+ * (`tagBackupTier`), because an aspect can only reach the resource by walking
+ * up the scope chain — which cannot tell an Aurora cluster from its member
+ * instances, or a primary from its read replica — and because `Tags.of(...)`
+ * called inside `visit()` is an aspect adding an aspect, dropped silently when
+ * `aspectStabilization` is off.
+ *
  * This aspect uses Tags.of(node).add() to properly merge with existing tags
  */
 export class StandardTagsAspect {
@@ -31,9 +37,6 @@ export class StandardTagsAspect {
         if (resource.cfnResourceType === "AWS::EC2::VPC") {
             this.addIpamPoolTag(resource);
         }
-        if (resource.cfnResourceType === "AWS::S3::Bucket") {
-            this.addBackupTierTag(resource);
-        }
     }
     /**
      * Add IPAM pool tag to VPCs that use IPAM for IP address allocation.
@@ -53,33 +56,4 @@ export class StandardTagsAspect {
             Tags.of(vpc).add(IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue(accountId, region));
         }
     }
-    /**
-     * Add the disaster recovery tier tag to S3 buckets from the bucket's
-     * effective tier — the per-bucket `backupVaultTier` override, else the
-     * app-level tier the factory threaded in. CDK child tags override parent
-     * tags, so an override wins over the app-level tag set via
-     * `App.getApp({ backup })`; an inherited app tier writes the value that tag
-     * already carries. The same resolution decides the bucket's versioning
-     * default (`S3Bucket`).
-     *
-     * Tag format: fjall:disasterRecovery:tier = "{tier}"
-     *
-     * Tier mapping:
-     * - standard -> "default" (matches existing backup plans)
-     * - resilient -> "resilient"
-     * - enterprise -> "enterprise"
-     */
-    addBackupTierTag(resource) {
-        let construct = resource;
-        while (construct) {
-            const backupConstruct = construct;
-            if (backupConstruct.effectiveBackupTier) {
-                const tier = backupConstruct.effectiveBackupTier;
-                const tagValue = BACKUP_TIER_TAG_MAP[tier];
-                Tags.of(resource).add(BACKUP_TIER_TAG_KEY, tagValue);
-                break;
-            }
-            construct = construct.node.scope;
-        }
-    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "37.0.0",
+  "version": "39.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -76,12 +76,12 @@
     "reflect-metadata": "^0.2.2",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^37.0.0",
-    "@fjall/util": "^37.0.0",
+    "@fjall/generator": "^39.0.0",
+    "@fjall/util": "^39.0.0",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },