@fjall/generator 2.24.0 → 2.27.0

package/dist/.minified

@@ -1 +1 @@
-141 files minified at 2026-07-05T07:50:57.469Z
+142 files minified at 2026-07-07T01:04:31.721Z

package/dist/src/presets/tierTypes.d.ts

@@ -85,7 +85,7 @@ export interface DatabaseTierPreset {
     publiclyAccessible?: boolean;
     encryption?: TierEncryptionConfig;
     databaseInsights?: TierDatabaseInsightsConfig | false;
-    /** Database port. Default: 35255 (FJALL on phone keypad) */
+    /** Database port. Default: engine default (5432 postgresql / 3306 mysql) */
     port?: number;
     /** RDS Proxy configuration for connection pooling. */
     proxy?: TierProxyConfig | false;

package/dist/src/schemas/constants.d.ts

@@ -63,10 +63,13 @@ export declare function constIncludes<T extends ReadonlyArray<string | number>>(
 export declare const MIN_PORT = 1;
 export declare const MAX_PORT = 65535;
 /**
- * Default database port: 35255 (FJALL on phone keypad)
- * Used when no explicit port is specified in tier presets or configuration.
+ * Engine-default database ports, used when no explicit port is specified in
+ * tier presets or configuration. These MUST stay the engine defaults: AWS RDS
+ * Proxy listens exclusively on the engine family's default port (CreateDBProxy
+ * has no port parameter), so a non-default fallback breaks every proxied tier.
+ * Single source of truth — the CDK constructs import this map.
  */
-export declare const DEFAULT_DATABASE_PORT = 35255;
+export declare const ENGINE_DEFAULT_DATABASE_PORTS: Record<DatabaseEngine, number>;
 export declare const MIN_LAMBDA_MEMORY = 128;
 export declare const MAX_LAMBDA_MEMORY = 10240;
 export declare const MIN_LAMBDA_TIMEOUT = 1;

package/dist/src/schemas/constants.js

@@ -1 +1 @@
-const t=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})});import{DATABASE_TYPES as q}from"./sharedTypes.js";const g=["ecs","lambda","ec2"],x=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),o=["code","container"],l=Object.freeze({CODE:"code",CONTAINER:"container"}),E=["ARM_64","X86_64"],c="ARM_64",A=["NONE","AWS_IAM"],T=["public","internal"],_=["CPU","MEMORY"],n=["ARM","STANDARD"],s=["Instance","Aurora"],S=["postgresql","mysql"],p=["foundation","compliance","hardened"];import{ECS_CAPACITY_PROVIDERS as y}from"./sharedTypes.js";const P="FARGATE",a=["payload","nextjs"],O=new Set(a);import{APP_TYPES as Z,CUSTOM_TIER as h}from"./sharedTypes.js";const R=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],C=[0,1,5,10,15,30,60];function m(e,r){return e.includes(r)}const I=1,M=65535,N=35255,D=128,L=10240,U=1,Y=900,i=1,d=1e3,u=100,F=100,f=1,B=!1,b=3e3,G="t4g.micro",H=30,X=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],V=["standard","assets","upload","website"],j=["AES256","KMS"];import{BACKUP_VAULT_TIERS as v}from"./sharedTypes.js";export{n as AMI_HARDWARE_TYPES,Z as APP_TYPES,v as BACKUP_VAULT_TIERS,E as COMPUTE_ARCHITECTURES,x as COMPUTE_TYPE,g as COMPUTE_TYPES,h as CUSTOM_TIER,S as DATABASE_ENGINES,q as DATABASE_TYPES,t as DEFAULTS,P as DEFAULT_CAPACITY_PROVIDER,c as DEFAULT_COMPUTE_ARCHITECTURE,b as DEFAULT_CONTAINER_PORT,N as DEFAULT_DATABASE_PORT,G as DEFAULT_EC2_INSTANCE_TYPE,H as DEFAULT_SECRET_ROTATION_DAYS,f as DEFAULT_WARM_POOL_MIN_SIZE,B as DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN,l as DEPLOYMENT_TYPE,o as DEPLOYMENT_TYPES,R as EC2_INSTANCE_TYPES,y as ECS_CAPACITY_PROVIDERS,A as FUNCTION_URL_AUTH_TYPES,p as GOVERNANCE_PRESETS,X as HTTP_METHODS,T as LOAD_BALANCER_TYPES,d as MAX_ECS_CAPACITY,L as MAX_LAMBDA_MEMORY,Y as MAX_LAMBDA_TIMEOUT,M as MAX_PORT,u as MAX_SCALING_CAPACITY,F as MAX_WARM_POOL_SIZE,i as MIN_ECS_CAPACITY,D as MIN_LAMBDA_MEMORY,U as MIN_LAMBDA_TIMEOUT,I as MIN_PORT,s as PATTERN_DATABASE_TYPES,O as PATTERN_TYPES,a as PATTERN_TYPE_VALUES,j as S3_ENCRYPTION_TYPES,_ as SCALING_TYPES,V as STORAGE_PRESET_TYPES,C as VALID_MONITORING_INTERVALS,m as constIncludes};
+const t=Object.freeze({RESOURCE_SUFFIXES:Object.freeze({storage:"Storage",database:"Database",cluster:"Cluster",function:"Function",instance:"Instance",compute:"Compute"})});import{DATABASE_TYPES as q}from"./sharedTypes.js";const g=["ecs","lambda","ec2"],x=Object.freeze({ECS:"ecs",LAMBDA:"lambda",EC2:"ec2"}),o=["code","container"],l=Object.freeze({CODE:"code",CONTAINER:"container"}),E=["ARM_64","X86_64"],c="ARM_64",A=["NONE","AWS_IAM"],T=["public","internal"],_=["CPU","MEMORY"],n=["ARM","STANDARD"],s=["Instance","Aurora"],S=["postgresql","mysql"],p=["foundation","compliance","hardened"];import{ECS_CAPACITY_PROVIDERS as w}from"./sharedTypes.js";const P="FARGATE",a=["payload","nextjs"],O=new Set(a);import{APP_TYPES as Z,CUSTOM_TIER as h}from"./sharedTypes.js";const R=["t3.nano","t3.micro","t3.small","t3.medium","t3.large","t3.xlarge","t3.2xlarge","t3a.nano","t3a.micro","t3a.small","t3a.medium","t3a.large","t3a.xlarge","t3a.2xlarge","t4g.nano","t4g.micro","t4g.small","t4g.medium","t4g.large","t4g.xlarge","t4g.2xlarge","c5.large","c5.xlarge","c5.2xlarge","c5.4xlarge","c5.9xlarge","c5.12xlarge","c5.18xlarge","c5.24xlarge","c5a.large","c5a.xlarge","c5a.2xlarge","c5a.4xlarge","c5a.8xlarge","c5a.12xlarge","c5a.16xlarge","c5a.24xlarge","c6g.medium","c6g.large","c6g.xlarge","c6g.2xlarge","c6g.4xlarge","c6g.8xlarge","c6g.12xlarge","c6g.16xlarge","r5.large","r5.xlarge","r5.2xlarge","r5.4xlarge","r5.8xlarge","r5.12xlarge","r5.16xlarge","r5.24xlarge","r5a.large","r5a.xlarge","r5a.2xlarge","r5a.4xlarge","r5a.8xlarge","r5a.12xlarge","r5a.16xlarge","r5a.24xlarge","r6g.medium","r6g.large","r6g.xlarge","r6g.2xlarge","r6g.4xlarge","r6g.8xlarge","r6g.12xlarge","r6g.16xlarge","i3.large","i3.xlarge","i3.2xlarge","i3.4xlarge","i3.8xlarge","i3.16xlarge","p3.2xlarge","p3.8xlarge","p3.16xlarge","g4dn.xlarge","g4dn.2xlarge","g4dn.4xlarge","g4dn.8xlarge","g4dn.12xlarge","g4dn.16xlarge","m5.large","m5.xlarge","m5.2xlarge","m5.4xlarge","m5.8xlarge","m5.12xlarge","m5.16xlarge","m5.24xlarge","m5a.large","m5a.xlarge","m5a.2xlarge","m5a.4xlarge","m5a.8xlarge","m5a.12xlarge","m5a.16xlarge","m5a.24xlarge"],C=[0,1,5,10,15,30,60];function m(e,r){return e.includes(r)}const I=1,M=65535,N=Object.freeze({postgresql:5432,mysql:3306}),D=128,L=10240,U=1,Y=900,i=1,d=1e3,u=100,F=100,f=1,b=!1,B=3e3,G="t4g.micro",H=30,X=["GET","POST","PUT","DELETE","HEAD","OPTIONS","PATCH"],V=["standard","assets","upload","website"],j=["AES256","KMS"];import{BACKUP_VAULT_TIERS as v}from"./sharedTypes.js";export{n as AMI_HARDWARE_TYPES,Z as APP_TYPES,v as BACKUP_VAULT_TIERS,E as COMPUTE_ARCHITECTURES,x as COMPUTE_TYPE,g as COMPUTE_TYPES,h as CUSTOM_TIER,S as DATABASE_ENGINES,q as DATABASE_TYPES,t as DEFAULTS,P as DEFAULT_CAPACITY_PROVIDER,c as DEFAULT_COMPUTE_ARCHITECTURE,B as DEFAULT_CONTAINER_PORT,G as DEFAULT_EC2_INSTANCE_TYPE,H as DEFAULT_SECRET_ROTATION_DAYS,f as DEFAULT_WARM_POOL_MIN_SIZE,b as DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN,l as DEPLOYMENT_TYPE,o as DEPLOYMENT_TYPES,R as EC2_INSTANCE_TYPES,w as ECS_CAPACITY_PROVIDERS,N as ENGINE_DEFAULT_DATABASE_PORTS,A as FUNCTION_URL_AUTH_TYPES,p as GOVERNANCE_PRESETS,X as HTTP_METHODS,T as LOAD_BALANCER_TYPES,d as MAX_ECS_CAPACITY,L as MAX_LAMBDA_MEMORY,Y as MAX_LAMBDA_TIMEOUT,M as MAX_PORT,u as MAX_SCALING_CAPACITY,F as MAX_WARM_POOL_SIZE,i as MIN_ECS_CAPACITY,D as MIN_LAMBDA_MEMORY,U as MIN_LAMBDA_TIMEOUT,I as MIN_PORT,s as PATTERN_DATABASE_TYPES,O as PATTERN_TYPES,a as PATTERN_TYPE_VALUES,j as S3_ENCRYPTION_TYPES,_ as SCALING_TYPES,V as STORAGE_PRESET_TYPES,C as VALID_MONITORING_INTERVALS,m as constIncludes};

package/dist/src/schemas/devRolePolicies.d.ts

@@ -0,0 +1,151 @@
+import { type BoundaryStatement } from "./securityBoundary.js";
+/**
+ * Dev-tier IAM surface for the fast-dev-environments server-side gate
+ * (aiDocs plans/2026-07-05-fast-dev-environments-implementation.md §4.2 G3/G4).
+ *
+ * This module is the single source of truth for the THREE policy vehicles that
+ * render the same dev-tier documents (three-rendering parity — security-load-
+ * bearing coupled values):
+ *   1. the connector CDK construct
+ *      (`components/infrastructure/lib/config/aws/oidcConnector.ts`) — consumes
+ *      these builders directly, so construct⇔SSoT parity holds by construction;
+ *   2. the static Quick-Create template
+ *      (`publicAssets/fjall/publicAssets/assets/oidc-connector.yaml`) — hand-
+ *      mirrors the rendered JSON, locked by the deep-compare fixture in
+ *      `components/infrastructure/lib/__tests__/devRoleParity.test.ts`;
+ *   3. the webapp `dev-gate-remediate` pass (Phase-2 Increment C) — imports
+ *      these builders via the `@fjall/generator/schemas` subpath.
+ *
+ * Roles rendered ONLY in development-STAGE accounts (workload stage — never
+ * the account TIER axis):
+ *   - `FjallDevDeploy{orgId}` — member-reachable, scoped dev policy (never
+ *     AdministratorAccess), trusted by `org:{orgId}:dev:{accountId}:*` only.
+ *   - `FjallDevProvisioner{orgId}` — worker-only IAM/master-secret privileges,
+ *     trusted by the server-minted `org:{orgId}:dev-provisioner` subject.
+ *   - `FjallDevSyncWriter{orgId}` — the §7 presigning principal, trusted by
+ *     the server-minted `org:{orgId}:dev-sync` subject.
+ *   - `FjallDevBoundary` — permissions boundary capping every role the
+ *     provisioner creates (per-slot task roles). NOT attached to the trio
+ *     themselves.
+ *
+ * Convention-scoping law: these documents are rendered at CONNECT time, before
+ * any app or substrate exists, so every resource scope is a naming/path/tag
+ * convention (`/fjall/dev/*`, `fjall-dev-*`, `fjall:dev=true`,
+ * `fjall-dev-sync-<accountId>-*`) — never a per-app instance ARN.
+ *
+ * Partition is hardcoded `aws` to match the Quick-Create template convention
+ * (`arn:aws:iam::aws:policy/AdministratorAccess`) — Fjall does not support
+ * GovCloud/China partitions.
+ */
+export interface DevPolicyParams {
+    /**
+     * 12-digit AWS account number of the development-stage account. CDK passes
+     * `Stack.of(this).account` (concrete — the account stack always sets env);
+     * the static yaml renders with the literal `${AWS::AccountId}` inside
+     * `!Sub`; the remediation pass passes the connected account's
+     * `awsAccountId`.
+     */
+    accountId: string;
+}
+export declare function devDeployRoleName(fjallOrgId: string): string;
+export declare function devProvisionerRoleName(fjallOrgId: string): string;
+export declare function devSyncWriterRoleName(fjallOrgId: string): string;
+/**
+ * Inline-policy names on the trio — coupled across all three rendering
+ * vehicles (the remediation pass's `PutRolePolicy` must target the same name
+ * the construct and yaml render, or it creates a SECOND policy alongside the
+ * stale one).
+ */
+export declare const DEV_DEPLOY_POLICY_NAME = "FjallDevDeployPolicy";
+export declare const DEV_PROVISIONER_POLICY_NAME = "FjallDevProvisionerPolicy";
+export declare const DEV_SYNC_WRITER_POLICY_NAME = "FjallDevSyncWriterPolicy";
+/**
+ * Deliberately NOT org-suffixed (unlike `deployBoundaryName`): the
+ * provisioner's `iam:PermissionsBoundary` condition needs an ARN writable at
+ * connect time, and the boundary content is org-independent (account
+ * conventions only). The `dev-gate-remediate` vehicle adopts on
+ * EntityAlreadyExists.
+ */
+export declare const DEV_BOUNDARY_POLICY_NAME = "FjallDevBoundary";
+export declare function devBoundaryPolicyArn(accountId: string): string;
+/** Server-minted service subject for the worker-only provisioner role. */
+export declare function devProvisionerSubject(fjallOrgId: string): string;
+/** Server-minted service subject for the §7 presigning sync-writer role. */
+export declare function devSyncSubject(fjallOrgId: string): string;
+/**
+ * One statement of an OIDC federated trust (assume-role policy) document.
+ * Distinct from `BoundaryStatement` because trust statements carry a
+ * Principal.
+ */
+export interface OidcTrustStatement {
+    Sid: string;
+    Effect: "Allow";
+    Principal: {
+        Federated: string;
+    };
+    Action: "sts:AssumeRoleWithWebIdentity";
+    Condition: Record<string, Record<string, string | string[]>>;
+}
+export interface OidcTrustParams {
+    fjallOrgId: string;
+    /** ARN of the account-global Fjall OIDC provider (token/`!Sub` reference). */
+    providerArn: string;
+    /** Issuer domain without scheme, e.g. `fjall.io`. */
+    issuerDomain: string;
+}
+/**
+ * G4 narrowed trust for `FjallDeploy{orgId}` — replaces the single bare
+ * `StringLike sub: org:{orgId}:*` (which matched EVERY subject including dev
+ * ones). Each condition class is its OWN Allow statement: conditions inside
+ * one statement AND together, so a single-statement rendering would match
+ * nothing.
+ *
+ * Dev subjects (`org:{orgId}:dev:…`) and the Phase-3 service subjects
+ * (`dev-provisioner`, `dev-sync`) match NONE of these — they have dedicated
+ * roles and must never assume the admin role.
+ */
+export declare function buildNarrowedDeployTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+/**
+ * Trust for `FjallDevDeploy{orgId}` — account-pinned: a bare `dev:*` would let
+ * a token minted for dev account A assume the role in dev account B, silently
+ * discarding G1's per-account intent in multi-dev-account orgs.
+ */
+export declare function buildDevDeployTrustStatements(params: OidcTrustParams & DevPolicyParams): OidcTrustStatement[];
+export declare function buildDevProvisionerTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+export declare function buildDevSyncWriterTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+/**
+ * `FjallDevDeploy{orgId}` identity policy — member-reachable, so it carries NO
+ * worker-only privileges (no IAM writes beyond resource-scoped PassRole, no
+ * master-secret read, no ECR deletes). The ECS/ELBv2/logs halves are each
+ * split into resource-tag-conditioned mutations, RequestTag-conditioned
+ * creates (+ the service's tag-on-create action), and unscoped reads — a
+ * single uniform tag-conditioned statement per service is not implementable
+ * (`ecs:RegisterTaskDefinition` supports only `aws:RequestTag`; several reads
+ * support no resource-level scoping at all).
+ */
+export declare function buildDevDeployPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevProvisioner{orgId}` identity policy — worker-only. IAM CreateRole
+ * cannot constrain the trust-policy CONTENT of the role being created, so
+ * every IAM-write privilege lives here (a member-reachable CreateRole would
+ * let any org member mint a boundary-compliant role trusted by an arbitrary
+ * external account).
+ */
+export declare function buildDevProvisionerPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevSyncWriter{orgId}` identity policy — the §7 presigning principal.
+ * The webapp assumes it per presign request with a per-slot-prefix inline
+ * session policy (server-enforceable — the webapp is the STS caller); this
+ * grant is the ceiling that session policy narrows. GetObject covers the
+ * CLI's presigned poll of the `.applied/<manifestId>` ack marker.
+ */
+export declare function buildDevSyncWriterPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevBoundary` — permissions boundary for every role the provisioner
+ * creates (per-slot task roles). A boundary is an INTERSECTION: an allow-set
+ * omission fails silently at task start, so this document and the step-3
+ * role policy must be maintained as a pair. Allow-set is exactly what a slot
+ * task needs and nothing more — NO IAM actions at all, so even a role created
+ * through the conditioned path cannot mint further roles.
+ */
+export declare function buildDevBoundaryStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];

package/dist/src/schemas/devRolePolicies.js

@@ -0,0 +1 @@
+function u(e){return`FjallDevDeploy${e}`}function d(e){return`FjallDevProvisioner${e}`}function g(e){return`FjallDevSyncWriter${e}`}const f="FjallDevDeployPolicy",v="FjallDevProvisionerPolicy",A="FjallDevSyncWriterPolicy",s="FjallDevBoundary";function i(e){return`arn:aws:iam::${e}:policy/${s}`}function n(e){return`org:${e}:dev-provisioner`}function c(e){return`org:${e}:dev-sync`}function S(e){const{fjallOrgId:a,providerArn:t,issuerDomain:l}=e,o={[`${l}:aud`]:"sts.amazonaws.com"};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:`org:${a}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${l}:sub`]:`org:${a}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:[`org:${a}:discovery`,`org:${a}:connection`,`org:${a}:org-setup`]}}}]}function D(e){const{fjallOrgId:a,providerArn:t,issuerDomain:l,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${l}:aud`]:"sts.amazonaws.com"},StringLike:{[`${l}:sub`]:`org:${a}:dev:${o}:*`}}}]}function r(e){const{providerArn:a,issuerDomain:t,sid:l,subject:o}=e;return[{Sid:l,Effect:"Allow",Principal:{Federated:a},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:"sts.amazonaws.com",[`${t}:sub`]:o}}}]}function R(e){return r({...e,sid:"FjallDevProvisionerSubject",subject:n(e.fjallOrgId)})}function m(e){return r({...e,sid:"FjallDevSyncSubject",subject:c(e.fjallOrgId)})}function j({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}function w({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":i(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}function E({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}function p({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}export{s as DEV_BOUNDARY_POLICY_NAME,f as DEV_DEPLOY_POLICY_NAME,v as DEV_PROVISIONER_POLICY_NAME,A as DEV_SYNC_WRITER_POLICY_NAME,p as buildDevBoundaryStatements,j as buildDevDeployPolicyStatements,D as buildDevDeployTrustStatements,w as buildDevProvisionerPolicyStatements,R as buildDevProvisionerTrustStatements,E as buildDevSyncWriterPolicyStatements,m as buildDevSyncWriterTrustStatements,S as buildNarrowedDeployTrustStatements,i as devBoundaryPolicyArn,u as devDeployRoleName,d as devProvisionerRoleName,n as devProvisionerSubject,c as devSyncSubject,g as devSyncWriterRoleName};

package/dist/src/schemas/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./resourceSchemas.js";
 export * from "./constants.js";
 export * from "./securityBoundary.js";
+export * from "./devRolePolicies.js";
 export { type AmiHardwareType, getArchitectureForInstanceType, validateArchitectureMatch, isArchitectureCompatible, } from "./instanceTypeArchitecture.js";

package/dist/src/schemas/index.js

@@ -1 +1 @@
-export*from"./resourceSchemas.js";export*from"./constants.js";export*from"./securityBoundary.js";import{getArchitectureForInstanceType as i,validateArchitectureMatch as p,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{i as getArchitectureForInstanceType,a as isArchitectureCompatible,p as validateArchitectureMatch};
+export*from"./resourceSchemas.js";export*from"./constants.js";export*from"./securityBoundary.js";export*from"./devRolePolicies.js";import{getArchitectureForInstanceType as i,validateArchitectureMatch as m,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{i as getArchitectureForInstanceType,a as isArchitectureCompatible,m as validateArchitectureMatch};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "2.23.1";
+export declare const GENERATOR_VERSION = "2.26.1";

package/dist/src/version.js

@@ -1 +1 @@
-const E="2.23.1";export{E as GENERATOR_VERSION};
+const E="2.26.1";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "2.24.0",
+  "version": "2.27.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -47,7 +47,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^2.24.0",
+    "@fjall/util": "^2.27.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -63,5 +63,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "616d7af846f0eebfa3409f5f47c98fbee836bad9"
+  "gitHead": "921ecd4f65f52c17037a8a24834d7e4c196b9347"
 }