@fjall/generator 2.27.0 → 2.29.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/.minified
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
142 files minified at 2026-07-
|
|
1
|
+
142 files minified at 2026-07-13T22:22:07.030Z
|
|
@@ -37,6 +37,27 @@ import { type BoundaryStatement } from "./securityBoundary.js";
|
|
|
37
37
|
* (`arn:aws:iam::aws:policy/AdministratorAccess`) — Fjall does not support
|
|
38
38
|
* GovCloud/China partitions.
|
|
39
39
|
*/
|
|
40
|
+
/**
|
|
41
|
+
* Account-global Fjall OIDC provider spec — the coupled values every creator
|
|
42
|
+
* and prober of the `https://fjall.io` IAM provider must share byte-for-byte:
|
|
43
|
+
* 1. the OidcConnector adopt-or-create handler
|
|
44
|
+
* (`components/infrastructure/lib/config/aws/oidcConnector.ts`) —
|
|
45
|
+
* interpolates these at synth time;
|
|
46
|
+
* 2. the Quick-Create template (`oidc-connector.yaml` — hand-mirrored,
|
|
47
|
+
* `FjallIssuerDomain` default + thumbprint literals);
|
|
48
|
+
* 3. deploy-core's post-deploy reconcile and offboarding teardown
|
|
49
|
+
* (`deploy-core/src/aws/organisations/oidcProvider.ts`).
|
|
50
|
+
* A recreated provider with a drifted audience or URL silently breaks every
|
|
51
|
+
* web-identity assume in the account (scans AND deploys), so the create path
|
|
52
|
+
* must be identical wherever it runs.
|
|
53
|
+
*
|
|
54
|
+
* The thumbprint is a placeholder — IAM validates current OIDC issuers
|
|
55
|
+
* against its trusted-CA library and ignores the thumbprint list, but the
|
|
56
|
+
* API still requires a well-formed value.
|
|
57
|
+
*/
|
|
58
|
+
export declare const FJALL_OIDC_ISSUER_DOMAIN = "fjall.io";
|
|
59
|
+
export declare const FJALL_OIDC_AUDIENCE = "sts.amazonaws.com";
|
|
60
|
+
export declare const FJALL_OIDC_PLACEHOLDER_THUMBPRINT = "0000000000000000000000000000000000000000";
|
|
40
61
|
export interface DevPolicyParams {
|
|
41
62
|
/**
|
|
42
63
|
* 12-digit AWS account number of the development-stage account. CDK passes
|
|
@@ -1 +1 @@
|
|
|
1
|
-
function
|
|
1
|
+
const d="fjall.io",r="sts.amazonaws.com",g="0000000000000000000000000000000000000000";function f(e){return`FjallDevDeploy${e}`}function v(e){return`FjallDevProvisioner${e}`}function A(e){return`FjallDevSyncWriter${e}`}const D="FjallDevDeployPolicy",S="FjallDevProvisionerPolicy",R="FjallDevSyncWriterPolicy",i="FjallDevBoundary";function n(e){return`arn:aws:iam::${e}:policy/${i}`}function c(e){return`org:${e}:dev-provisioner`}function u(e){return`org:${e}:dev-sync`}function j(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a}=e,o={[`${a}:aud`]:r};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${a}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${a}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`]}}}]}function m(e){const{fjallOrgId:l,providerArn:t,issuerDomain:a,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${a}:aud`]:r},StringLike:{[`${a}:sub`]:`org:${l}:dev:${o}:*`}}}]}function s(e){const{providerArn:l,issuerDomain:t,sid:a,subject:o}=e;return[{Sid:a,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:r,[`${t}:sub`]:o}}}]}function E(e){return s({...e,sid:"FjallDevProvisionerSubject",subject:c(e.fjallOrgId)})}function w(e){return s({...e,sid:"FjallDevSyncSubject",subject:u(e.fjallOrgId)})}function p({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}function y({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":n(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}function b({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}function P({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}export{i as DEV_BOUNDARY_POLICY_NAME,D as DEV_DEPLOY_POLICY_NAME,S as DEV_PROVISIONER_POLICY_NAME,R as DEV_SYNC_WRITER_POLICY_NAME,r as FJALL_OIDC_AUDIENCE,d as FJALL_OIDC_ISSUER_DOMAIN,g as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,P as buildDevBoundaryStatements,p as buildDevDeployPolicyStatements,m as buildDevDeployTrustStatements,y as buildDevProvisionerPolicyStatements,E as buildDevProvisionerTrustStatements,b as buildDevSyncWriterPolicyStatements,w as buildDevSyncWriterTrustStatements,j as buildNarrowedDeployTrustStatements,n as devBoundaryPolicyArn,f as devDeployRoleName,v as devProvisionerRoleName,c as devProvisionerSubject,u as devSyncSubject,A as devSyncWriterRoleName};
|
package/dist/src/version.d.ts
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
export declare const GENERATOR_VERSION = "2.
|
|
1
|
+
export declare const GENERATOR_VERSION = "2.28.0";
|
package/dist/src/version.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
const E="2.
|
|
1
|
+
const E="2.28.0";export{E as GENERATOR_VERSION};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@fjall/generator",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.29.0",
|
|
4
4
|
"description": "Pure infrastructure generation logic for Fjall",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/src/index.js",
|
|
@@ -47,7 +47,7 @@
|
|
|
47
47
|
},
|
|
48
48
|
"license": "SEE LICENSE IN LICENSE",
|
|
49
49
|
"dependencies": {
|
|
50
|
-
"@fjall/util": "^2.
|
|
50
|
+
"@fjall/util": "^2.29.0",
|
|
51
51
|
"ast-types": "^0.16.1",
|
|
52
52
|
"recast": "^0.23.11",
|
|
53
53
|
"ts-morph": "^28.0.0",
|
|
@@ -63,5 +63,5 @@
|
|
|
63
63
|
"typescript-eslint": "^8.59.1",
|
|
64
64
|
"vitest": "^4.1.5"
|
|
65
65
|
},
|
|
66
|
-
"gitHead": "
|
|
66
|
+
"gitHead": "c40ea0e1435400f3f42faaad5bcbf50e4400c1d4"
|
|
67
67
|
}
|