@fjall/components-infrastructure 4.3.0 → 4.4.0

package/dist/lib/config/aws/oidcConnector.d.ts

@@ -1,4 +1,4 @@
-import { type GovernancePreset } from "@fjall/generator";
+import { type GovernancePreset, type MachineTrustMode } from "@fjall/generator";
 import { type AccountTier } from "@fjall/util";
 import { Construct } from "constructs";
 export interface OidcConnectorProps {
@@ -32,6 +32,15 @@ export interface OidcConnectorProps {
      * ("account") or absent ⇒ generic-only scalar (unchanged, fail-safe).
      */
     accountTier?: AccountTier;
+    /**
+     * §4.4a Step-3 contract knob, forwarded verbatim to
+     * `buildNarrowedDeployTrustStatements`. Absent ⇒ `"expanded"` (the safe
+     * shared default). `"account-scoped"` renders the machine statement with the
+     * account-scoped literal ONLY and throws at synth unless `accountTier` is
+     * governance — opt in solely where per-account issuance is known-flipped
+     * (see `MachineTrustMode` in `@fjall/generator`).
+     */
+    machineTrustMode?: MachineTrustMode;
 }
 export declare class OidcConnector extends Construct {
     readonly deployRoleArn: string;

package/dist/lib/config/aws/oidcConnector.js

@@ -123,7 +123,12 @@ export class OidcConnector extends Construct {
             providerArn,
             issuerDomain,
             accountId,
-            ...(props.accountTier !== undefined && { accountTier: props.accountTier })
+            ...(props.accountTier !== undefined && {
+                accountTier: props.accountTier
+            }),
+            ...(props.machineTrustMode !== undefined && {
+                machineTrustMode: props.machineTrustMode
+            })
         };
         const deployRole = new Role(this, "DeployRole", {
             roleName: `FjallDeploy${props.fjallOrgId}`,

package/dist/lib/patterns/aws/account.d.ts

@@ -12,7 +12,7 @@ import type { SecurityHubHubProps } from "../../config/aws/securityHubHub.js";
 import type { ConfigRecorderProps } from "../../config/aws/configRecorder.js";
 import type { ConfigRulePresetProps } from "../../config/aws/configRulePreset.js";
 import type { OrganisationType } from "./interfaces/organisation.js";
-import { type GovernancePreset } from "@fjall/generator";
+import { type GovernancePreset, type MachineTrustMode } from "@fjall/generator";
 import { type AccountTier } from "@fjall/util";
 export interface AccountProps extends StackProps {
     accountId?: string;
@@ -34,6 +34,18 @@ export interface AccountProps extends StackProps {
      * `securityTier`.
      */
     alarmSubscriptions?: SharedAlarmTopicProps["subscriptions"];
+    /**
+     * §4.4a Step-3 contract knob, forwarded to this account's `OidcConnector`.
+     * Absent ⇒ `"expanded"` (the safe shared default — governance trust accepts
+     * both the generic and account-scoped machine subjects).
+     * `"account-scoped"` contracts the FjallDeploy machine trust to the
+     * account-scoped literal only; it throws at synth on a non-governance tier.
+     * Set it ONLY in a deployment whose per-account deploy-token issuance is
+     * known-flipped (Fjall's own governance accounts) — for any other org it
+     * would lock governance CI out at STS. Sourced from the generated
+     * `infrastructure.ts`, same as `securityTier`.
+     */
+    machineTrustMode?: MachineTrustMode;
 }
 export declare class Account extends Stack {
     readonly organisationType: OrganisationType;

package/dist/lib/patterns/aws/account.js

@@ -84,6 +84,9 @@ export class Account extends Stack {
                 accountTier: this.deployRoleAccountTier(),
                 ...(props.securityTier !== undefined && {
                     securityTier: props.securityTier
+                }),
+                ...(props.machineTrustMode !== undefined && {
+                    machineTrustMode: props.machineTrustMode
                 })
             });
         }

package/dist/lib/resources/aws/database/clickhouseConstants.d.ts

@@ -11,7 +11,7 @@ export declare const CLICKHOUSE_DATABASE_NAME = "analytics";
  *  columnar scans than Graviton2.
  *
  *  Settings are tuned for 1 vCPU sustained (max_threads=1 across all profiles,
- *  max_concurrent_queries=4) — see clickhouseUserData.ts. Bumping to a larger
+ *  max_concurrent_queries=8) — see clickhouseUserData.ts. Bumping to a larger
  *  instance MUST be paired with raising those thread/concurrency caps.
  *
  *  Next size up: `m7g.large` (2 vCPU, 8 GiB) for sustained workloads, or

package/dist/lib/resources/aws/database/clickhouseConstants.js

@@ -11,7 +11,7 @@ export const CLICKHOUSE_DATABASE_NAME = "analytics";
  *  columnar scans than Graviton2.
  *
  *  Settings are tuned for 1 vCPU sustained (max_threads=1 across all profiles,
- *  max_concurrent_queries=4) — see clickhouseUserData.ts. Bumping to a larger
+ *  max_concurrent_queries=8) — see clickhouseUserData.ts. Bumping to a larger
  *  instance MUST be paired with raising those thread/concurrency caps.
  *
  *  Next size up: `m7g.large` (2 vCPU, 8 GiB) for sustained workloads, or

package/dist/lib/resources/aws/database/clickhouseSchemas.js

@@ -90,7 +90,14 @@ export const PROFILE_NAME_PATTERN = NAME_PATTERN;
  * from the pre-Phase-4b inline `<app_writer>` / `<audit_writer>` /
  * `<backup_reader>` / `<schema_admin>` blocks at
  * `clickhouseUserData.ts:296-382` — zero behavioural drift from the
- * pre-4b prod resource caps.
+ * pre-4b prod resource caps, EXCEPT high_throughput_ingest's
+ * `maxConcurrentQueriesForUser`, deliberately raised 2→6 (2026-07-28):
+ * the webapp overview fires 6–10 queries per page load and the cap of 2
+ * threw TOO_MANY_SIMULTANEOUS_QUERIES instead of queueing (CH does not
+ * queue past this cap — `queue_max_wait_ms` empirically does not apply).
+ * Consumers pair it with a client-side FIFO gate
+ * (`webapp/app/.server/lib/clickhouse/appQuerySlots.ts`) whose limit
+ * MUST mirror this value — a users.xml parity test enforces the pair.
  *
  * Frozen via `Object.freeze` on the outer record AND each sub-object so
  * a consumer cannot mutate the defaults in place. Pass your own
@@ -101,7 +108,7 @@ const _ClickHouseDefaultProfilesRaw = {
     high_throughput_ingest: {
         maxThreads: 1,
         maxInsertThreads: 1,
-        maxConcurrentQueriesForUser: 2,
+        maxConcurrentQueriesForUser: 6,
         logQueriesMinQueryDurationMs: 100,
         optimizeMoveToPrewhere: true,
         useQueryConditionCache: true,

package/dist/lib/resources/aws/database/clickhouseUserData.js

@@ -119,13 +119,16 @@ export function generateServerConfigXml(options) {
     <!-- Filesystem page cache handles uncompressed-block warmth on the
          host side; an in-CH uncompressed cache would just duplicate it. -->
     <uncompressed_cache_size>0</uncompressed_cache_size>
-    <!-- Sized for m7g.medium (1 vCPU sustained). 4 concurrent queries is the
-         sweet spot: enough headroom for the OPTIMIZE FINAL sidecar + a single
-         dashboard read + one async insert + one ad-hoc, but low enough that
-         context switching does not dominate at the kernel scheduler level.
-         Bump in lockstep with instance size if DEFAULT_CLICKHOUSE_INSTANCE_TYPE
-         moves to a >=2 vCPU host. -->
-    <max_concurrent_queries>4</max_concurrent_queries>
+    <!-- Server-wide cap across ALL users. Raised 4→8 (2026-07-28) alongside
+         high_throughput_ingest's per-user cap (2→6): the webapp overview
+         fires 6-10 queries per page load and N app tasks share this cap, so
+         4 starved dashboard reads with TOO_MANY_SIMULTANEOUS_QUERIES (CH
+         rejects rather than queues past the cap). On the 1 vCPU m7g.medium
+         the extra slots time-slice rather than parallelise — acceptable for
+         short cache-hot dashboard reads; max_threads=1 per query keeps the
+         scheduler sane. Bump further in lockstep with instance size if
+         DEFAULT_CLICKHOUSE_INSTANCE_TYPE moves to a >=2 vCPU host. -->
+    <max_concurrent_queries>8</max_concurrent_queries>
     <background_pool_size>2</background_pool_size>
     <background_schedule_pool_size>2</background_schedule_pool_size>
     <background_merges_mutations_concurrency_ratio>2</background_merges_mutations_concurrency_ratio>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -67,8 +67,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1038.0",
-    "@fjall/generator": "^4.3.0",
-    "@fjall/util": "^4.3.0",
+    "@fjall/generator": "^4.4.0",
+    "@fjall/util": "^4.4.0",
     "constructs": "^10.6.0"
   },
   "overrides": {
@@ -82,5 +82,5 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "8a3ae096f9d15c47dc8c277c9bddfa40e4168c19"
+  "gitHead": "c700128600ab453fa63ce28b3effe8965373be43"
 }