@fjall/generator 2.25.0 → 2.29.0

package/dist/.minified

@@ -1 +1 @@
-141 files minified at 2026-07-06T11:56:40.960Z
+142 files minified at 2026-07-13T22:22:07.030Z

package/dist/src/schemas/devRolePolicies.d.ts

@@ -0,0 +1,172 @@
+import { type BoundaryStatement } from "./securityBoundary.js";
+/**
+ * Dev-tier IAM surface for the fast-dev-environments server-side gate
+ * (aiDocs plans/2026-07-05-fast-dev-environments-implementation.md §4.2 G3/G4).
+ *
+ * This module is the single source of truth for the THREE policy vehicles that
+ * render the same dev-tier documents (three-rendering parity — security-load-
+ * bearing coupled values):
+ *   1. the connector CDK construct
+ *      (`components/infrastructure/lib/config/aws/oidcConnector.ts`) — consumes
+ *      these builders directly, so construct⇔SSoT parity holds by construction;
+ *   2. the static Quick-Create template
+ *      (`publicAssets/fjall/publicAssets/assets/oidc-connector.yaml`) — hand-
+ *      mirrors the rendered JSON, locked by the deep-compare fixture in
+ *      `components/infrastructure/lib/__tests__/devRoleParity.test.ts`;
+ *   3. the webapp `dev-gate-remediate` pass (Phase-2 Increment C) — imports
+ *      these builders via the `@fjall/generator/schemas` subpath.
+ *
+ * Roles rendered ONLY in development-STAGE accounts (workload stage — never
+ * the account TIER axis):
+ *   - `FjallDevDeploy{orgId}` — member-reachable, scoped dev policy (never
+ *     AdministratorAccess), trusted by `org:{orgId}:dev:{accountId}:*` only.
+ *   - `FjallDevProvisioner{orgId}` — worker-only IAM/master-secret privileges,
+ *     trusted by the server-minted `org:{orgId}:dev-provisioner` subject.
+ *   - `FjallDevSyncWriter{orgId}` — the §7 presigning principal, trusted by
+ *     the server-minted `org:{orgId}:dev-sync` subject.
+ *   - `FjallDevBoundary` — permissions boundary capping every role the
+ *     provisioner creates (per-slot task roles). NOT attached to the trio
+ *     themselves.
+ *
+ * Convention-scoping law: these documents are rendered at CONNECT time, before
+ * any app or substrate exists, so every resource scope is a naming/path/tag
+ * convention (`/fjall/dev/*`, `fjall-dev-*`, `fjall:dev=true`,
+ * `fjall-dev-sync-<accountId>-*`) — never a per-app instance ARN.
+ *
+ * Partition is hardcoded `aws` to match the Quick-Create template convention
+ * (`arn:aws:iam::aws:policy/AdministratorAccess`) — Fjall does not support
+ * GovCloud/China partitions.
+ */
+/**
+ * Account-global Fjall OIDC provider spec — the coupled values every creator
+ * and prober of the `https://fjall.io` IAM provider must share byte-for-byte:
+ *   1. the OidcConnector adopt-or-create handler
+ *      (`components/infrastructure/lib/config/aws/oidcConnector.ts`) —
+ *      interpolates these at synth time;
+ *   2. the Quick-Create template (`oidc-connector.yaml` — hand-mirrored,
+ *      `FjallIssuerDomain` default + thumbprint literals);
+ *   3. deploy-core's post-deploy reconcile and offboarding teardown
+ *      (`deploy-core/src/aws/organisations/oidcProvider.ts`).
+ * A recreated provider with a drifted audience or URL silently breaks every
+ * web-identity assume in the account (scans AND deploys), so the create path
+ * must be identical wherever it runs.
+ *
+ * The thumbprint is a placeholder — IAM validates current OIDC issuers
+ * against its trusted-CA library and ignores the thumbprint list, but the
+ * API still requires a well-formed value.
+ */
+export declare const FJALL_OIDC_ISSUER_DOMAIN = "fjall.io";
+export declare const FJALL_OIDC_AUDIENCE = "sts.amazonaws.com";
+export declare const FJALL_OIDC_PLACEHOLDER_THUMBPRINT = "0000000000000000000000000000000000000000";
+export interface DevPolicyParams {
+    /**
+     * 12-digit AWS account number of the development-stage account. CDK passes
+     * `Stack.of(this).account` (concrete — the account stack always sets env);
+     * the static yaml renders with the literal `${AWS::AccountId}` inside
+     * `!Sub`; the remediation pass passes the connected account's
+     * `awsAccountId`.
+     */
+    accountId: string;
+}
+export declare function devDeployRoleName(fjallOrgId: string): string;
+export declare function devProvisionerRoleName(fjallOrgId: string): string;
+export declare function devSyncWriterRoleName(fjallOrgId: string): string;
+/**
+ * Inline-policy names on the trio — coupled across all three rendering
+ * vehicles (the remediation pass's `PutRolePolicy` must target the same name
+ * the construct and yaml render, or it creates a SECOND policy alongside the
+ * stale one).
+ */
+export declare const DEV_DEPLOY_POLICY_NAME = "FjallDevDeployPolicy";
+export declare const DEV_PROVISIONER_POLICY_NAME = "FjallDevProvisionerPolicy";
+export declare const DEV_SYNC_WRITER_POLICY_NAME = "FjallDevSyncWriterPolicy";
+/**
+ * Deliberately NOT org-suffixed (unlike `deployBoundaryName`): the
+ * provisioner's `iam:PermissionsBoundary` condition needs an ARN writable at
+ * connect time, and the boundary content is org-independent (account
+ * conventions only). The `dev-gate-remediate` vehicle adopts on
+ * EntityAlreadyExists.
+ */
+export declare const DEV_BOUNDARY_POLICY_NAME = "FjallDevBoundary";
+export declare function devBoundaryPolicyArn(accountId: string): string;
+/** Server-minted service subject for the worker-only provisioner role. */
+export declare function devProvisionerSubject(fjallOrgId: string): string;
+/** Server-minted service subject for the §7 presigning sync-writer role. */
+export declare function devSyncSubject(fjallOrgId: string): string;
+/**
+ * One statement of an OIDC federated trust (assume-role policy) document.
+ * Distinct from `BoundaryStatement` because trust statements carry a
+ * Principal.
+ */
+export interface OidcTrustStatement {
+    Sid: string;
+    Effect: "Allow";
+    Principal: {
+        Federated: string;
+    };
+    Action: "sts:AssumeRoleWithWebIdentity";
+    Condition: Record<string, Record<string, string | string[]>>;
+}
+export interface OidcTrustParams {
+    fjallOrgId: string;
+    /** ARN of the account-global Fjall OIDC provider (token/`!Sub` reference). */
+    providerArn: string;
+    /** Issuer domain without scheme, e.g. `fjall.io`. */
+    issuerDomain: string;
+}
+/**
+ * G4 narrowed trust for `FjallDeploy{orgId}` — replaces the single bare
+ * `StringLike sub: org:{orgId}:*` (which matched EVERY subject including dev
+ * ones). Each condition class is its OWN Allow statement: conditions inside
+ * one statement AND together, so a single-statement rendering would match
+ * nothing.
+ *
+ * Dev subjects (`org:{orgId}:dev:…`) and the Phase-3 service subjects
+ * (`dev-provisioner`, `dev-sync`) match NONE of these — they have dedicated
+ * roles and must never assume the admin role.
+ */
+export declare function buildNarrowedDeployTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+/**
+ * Trust for `FjallDevDeploy{orgId}` — account-pinned: a bare `dev:*` would let
+ * a token minted for dev account A assume the role in dev account B, silently
+ * discarding G1's per-account intent in multi-dev-account orgs.
+ */
+export declare function buildDevDeployTrustStatements(params: OidcTrustParams & DevPolicyParams): OidcTrustStatement[];
+export declare function buildDevProvisionerTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+export declare function buildDevSyncWriterTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+/**
+ * `FjallDevDeploy{orgId}` identity policy — member-reachable, so it carries NO
+ * worker-only privileges (no IAM writes beyond resource-scoped PassRole, no
+ * master-secret read, no ECR deletes). The ECS/ELBv2/logs halves are each
+ * split into resource-tag-conditioned mutations, RequestTag-conditioned
+ * creates (+ the service's tag-on-create action), and unscoped reads — a
+ * single uniform tag-conditioned statement per service is not implementable
+ * (`ecs:RegisterTaskDefinition` supports only `aws:RequestTag`; several reads
+ * support no resource-level scoping at all).
+ */
+export declare function buildDevDeployPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevProvisioner{orgId}` identity policy — worker-only. IAM CreateRole
+ * cannot constrain the trust-policy CONTENT of the role being created, so
+ * every IAM-write privilege lives here (a member-reachable CreateRole would
+ * let any org member mint a boundary-compliant role trusted by an arbitrary
+ * external account).
+ */
+export declare function buildDevProvisionerPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevSyncWriter{orgId}` identity policy — the §7 presigning principal.
+ * The webapp assumes it per presign request with a per-slot-prefix inline
+ * session policy (server-enforceable — the webapp is the STS caller); this
+ * grant is the ceiling that session policy narrows. GetObject covers the
+ * CLI's presigned poll of the `.applied/<manifestId>` ack marker.
+ */
+export declare function buildDevSyncWriterPolicyStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];
+/**
+ * `FjallDevBoundary` — permissions boundary for every role the provisioner
+ * creates (per-slot task roles). A boundary is an INTERSECTION: an allow-set
+ * omission fails silently at task start, so this document and the step-3
+ * role policy must be maintained as a pair. Allow-set is exactly what a slot
+ * task needs and nothing more — NO IAM actions at all, so even a role created
+ * through the conditioned path cannot mint further roles.
+ */
+export declare function buildDevBoundaryStatements({ accountId, }: DevPolicyParams): BoundaryStatement[];

package/dist/src/schemas/devRolePolicies.js

@@ -0,0 +1 @@
+const d="fjall.io",r="sts.amazonaws.com",g="0000000000000000000000000000000000000000";function f(e){return`FjallDevDeploy${e}`}function v(e){return`FjallDevProvisioner${e}`}function A(e){return`FjallDevSyncWriter${e}`}const D="FjallDevDeployPolicy",S="FjallDevProvisionerPolicy",R="FjallDevSyncWriterPolicy",i="FjallDevBoundary";function n(e){return`arn:aws:iam::${e}:policy/${i}`}function c(e){return`org:${e}:dev-provisioner`}function u(e){return`org:${e}:dev-sync`}function j(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a}=e,o={[`${a}:aud`]:r};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${a}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`]}}}]}function m(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${a}:aud`]:r},StringLike:{[`${a}:sub`]:`org:${l}:dev:${o}:*`}}}]}function s(e){const{providerArn:l,issuerDomain:t,sid:a,subject:o}=e;return[{Sid:a,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:r,[`${t}:sub`]:o}}}]}function E(e){return s({...e,sid:"FjallDevProvisionerSubject",subject:c(e.fjallOrgId)})}function w(e){return s({...e,sid:"FjallDevSyncSubject",subject:u(e.fjallOrgId)})}function p({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}function y({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":n(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}function b({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}function P({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}export{i as DEV_BOUNDARY_POLICY_NAME,D as DEV_DEPLOY_POLICY_NAME,S as DEV_PROVISIONER_POLICY_NAME,R as DEV_SYNC_WRITER_POLICY_NAME,r as FJALL_OIDC_AUDIENCE,d as FJALL_OIDC_ISSUER_DOMAIN,g as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,P as buildDevBoundaryStatements,p as buildDevDeployPolicyStatements,m as buildDevDeployTrustStatements,y as buildDevProvisionerPolicyStatements,E as buildDevProvisionerTrustStatements,b as buildDevSyncWriterPolicyStatements,w as buildDevSyncWriterTrustStatements,j as buildNarrowedDeployTrustStatements,n as devBoundaryPolicyArn,f as devDeployRoleName,v as devProvisionerRoleName,c as devProvisionerSubject,u as devSyncSubject,A as devSyncWriterRoleName};

package/dist/src/schemas/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./resourceSchemas.js";
 export * from "./constants.js";
 export * from "./securityBoundary.js";
+export * from "./devRolePolicies.js";
 export { type AmiHardwareType, getArchitectureForInstanceType, validateArchitectureMatch, isArchitectureCompatible, } from "./instanceTypeArchitecture.js";

package/dist/src/schemas/index.js

@@ -1 +1 @@
-export*from"./resourceSchemas.js";export*from"./constants.js";export*from"./securityBoundary.js";import{getArchitectureForInstanceType as i,validateArchitectureMatch as p,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{i as getArchitectureForInstanceType,a as isArchitectureCompatible,p as validateArchitectureMatch};
+export*from"./resourceSchemas.js";export*from"./constants.js";export*from"./securityBoundary.js";export*from"./devRolePolicies.js";import{getArchitectureForInstanceType as i,validateArchitectureMatch as m,isArchitectureCompatible as a}from"./instanceTypeArchitecture.js";export{i as getArchitectureForInstanceType,a as isArchitectureCompatible,m as validateArchitectureMatch};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "2.24.0";
+export declare const GENERATOR_VERSION = "2.28.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="2.24.0";export{E as GENERATOR_VERSION};
+const E="2.28.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "2.25.0",
+  "version": "2.29.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -47,7 +47,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^2.25.0",
+    "@fjall/util": "^2.29.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -63,5 +63,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "7c1a329184064aefa557c2c09de0965c4f8cd4fb"
+  "gitHead": "c40ea0e1435400f3f42faaad5bcbf50e4400c1d4"
 }