@fjall/generator 3.3.0 → 3.4.1

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-18T12:19:05.639Z
+146 files minified at 2026-07-18T23:08:25.787Z

package/dist/src/schemas/devRolePolicies.d.ts

@@ -125,9 +125,12 @@ export interface OidcTrustParams {
  * one statement AND together, so a single-statement rendering would match
  * nothing.
  *
- * Dev subjects (`org:{orgId}:dev:…`) and the Phase-3 service subjects
+ * Dev subjects (`org:{orgId}:dev:…`) and the Phase-3 slot-ops service subjects
  * (`dev-provisioner`, `dev-sync`) match NONE of these — they have dedicated
- * roles and must never assume the admin role.
+ * roles and must never assume the admin role. `dev-substrate-setup` is the
+ * deliberate exception: substrate SETUP provisions CFN/Route53/Aurora/ECS the
+ * scoped dev-tier roles AccessDeny, so it runs under the admin role like
+ * `org-setup` (design "Deploy-role boundary" VERDICT-2).
  */
 export declare function buildNarrowedDeployTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
 /**

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",s="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function S(e){return`FjallDevDeploy${e}`}a(S,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",E="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function w(e){const{fjallOrgId:l,providerArn:o,issuerDomain:t}=e,r={[`${t}:aud`]:s};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:r,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...r,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`]}}}]}a(w,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:o,issuerDomain:t,accountId:r}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:s},StringLike:{[`${t}:sub`]:`org:${l}:dev:${r}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:o,sid:t,subject:r}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${o}:aud`]:s,[`${o}:sub`]:r}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,E as DEV_SYNC_WRITER_POLICY_NAME,s as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,w as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,S as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};
+var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",s="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function S(e){return`FjallDevDeploy${e}`}a(S,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",E="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function w(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t}=e,o={[`${t}:aud`]:s};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`,`org:${l}:dev-substrate-setup`]}}}]}a(w,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:s},StringLike:{[`${t}:sub`]:`org:${l}:dev:${o}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:r,sid:t,subject:o}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:s,[`${r}:sub`]:o}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,E as DEV_SYNC_WRITER_POLICY_NAME,s as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,w as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,S as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "3.3.0";
+export declare const GENERATOR_VERSION = "3.4.1";

package/dist/src/version.js

@@ -1 +1 @@
-const E="3.3.0";export{E as GENERATOR_VERSION};
+const E="3.4.1";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "3.3.0",
+  "version": "3.4.1",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^3.3.0",
+    "@fjall/util": "^3.4.1",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "cc1e0f520f4b6b5312e16df3751d60ea746dfb7d"
+  "gitHead": "6d8ef9582d5abe6a8199431815dae761887c18d4"
 }