@fjall/generator 3.4.1 → 3.5.2

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-18T23:08:25.787Z
+146 files minified at 2026-07-19T20:59:24.927Z

package/dist/src/schemas/buildkiteSchemas.d.ts

@@ -8,7 +8,7 @@ import { z } from "zod";
 export declare const BuildkitePropsObjectSchema: z.ZodObject<{
     buildkiteQueue: z.ZodString;
     buildkiteOrgSlug: z.ZodString;
-    agentTokenSsmParameterName: z.ZodString;
+    agentTokenSsmParameterName: z.ZodOptional<z.ZodString>;
     agentTokenKmsKeyArn: z.ZodOptional<z.ZodString>;
     fjallApiKeySsmParameterName: z.ZodOptional<z.ZodString>;
     instanceType: z.ZodDefault<z.ZodString>;
@@ -68,7 +68,7 @@ export type BuildkitePropsObject = z.infer<typeof BuildkitePropsObjectSchema>;
 export declare const BuildkitePropsSchema: z.ZodObject<{
     buildkiteQueue: z.ZodString;
     buildkiteOrgSlug: z.ZodString;
-    agentTokenSsmParameterName: z.ZodString;
+    agentTokenSsmParameterName: z.ZodOptional<z.ZodString>;
     agentTokenKmsKeyArn: z.ZodOptional<z.ZodString>;
     fjallApiKeySsmParameterName: z.ZodOptional<z.ZodString>;
     instanceType: z.ZodDefault<z.ZodString>;

package/dist/src/schemas/buildkiteSchemas.js

@@ -1,3 +1,3 @@
-var r=Object.defineProperty;var i=(n,t)=>r(n,"name",{value:t,configurable:!0});import{z as e}from"zod";const s=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],o=e.object({buildkiteQueue:e.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:e.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:e.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)"),agentTokenKmsKeyArn:e.string().min(1).optional(),fjallApiKeySsmParameterName:e.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:e.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:e.number().int().min(20).max(1e3).default(250),agentMinInstances:e.number().int().min(0).default(0),agentMaxInstances:e.number().int().min(1).default(2),agentsPerInstance:e.number().int().min(1).default(1),spotCapacityPercentage:e.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:e.number().int().min(60).default(600),disconnectAfterUptimeSeconds:e.number().int().min(3600).default(86400),maxInstanceLifetimeDays:e.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:e.boolean().default(!1),purgeBuildsOnDiskFull:e.boolean().default(!0),terminateInstanceOnDiskFull:e.boolean().default(!1),logRetentionDays:e.number().int().min(1).default(30),agentLogRetentionDays:e.literal(s).default(7),buildkiteAgentRelease:e.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:e.string().default(""),buildkiteAgentTimestampLines:e.boolean().default(!1),buildkiteAgentExperiments:e.string().default(""),buildkiteAgentTracingBackend:e.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:e.number().int().min(10).default(60),enableSecretsPlugin:e.boolean().default(!0),enableEcrPlugin:e.boolean().default(!1),enableDockerLoginPlugin:e.boolean().default(!1),enableDockerUserNamespaceRemap:e.boolean().default(!0),enableDockerExperimental:e.boolean().default(!1),dockerNetworkingProtocol:e.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:e.boolean().default(!1),mountTmpfsAtTmp:e.boolean().default(!0),buildkiteAgentEnableGitMirrors:e.boolean().default(!1),bootstrapScriptUrl:e.string().default(""),agentEnvFileUrl:e.string().default(""),scalerEventSchedulePeriod:e.string().min(1).default("1 minute"),scalerMinPollInterval:e.string().min(1).default("10s"),scaleOutFactor:e.string().min(1).default("1.0"),scaleOutWaitingForJobs:e.boolean().default(!1),rolePermissionsBoundaryArn:e.string().min(1).optional(),alarmSnsTopicArn:e.string().min(1).optional(),applicationId:e.string().min(1).optional(),costAllocationEnvironment:e.string().min(1).optional(),costAllocationOwner:e.string().min(1).optional()}).strict(),u=o.refine(n=>n.agentMinInstances<=n.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function g(n){const t=u.safeParse(n);if(!t.success){const l=t.error.issues.map(a=>`  - ${a.path.join(".")||"(root)"}: ${a.message}`).join(`
+var r=Object.defineProperty;var i=(n,t)=>r(n,"name",{value:t,configurable:!0});import{z as e}from"zod";const s=[1,3,5,7,14,30,60,90,120,150,180,365,400,545,731,1827,3653],o=e.object({buildkiteQueue:e.string().min(1,"buildkiteQueue cannot be empty").max(100).regex(/^[a-zA-Z0-9-_]+$/,"buildkiteQueue must be alphanumeric with hyphens/underscores"),buildkiteOrgSlug:e.string().min(1,"buildkiteOrgSlug cannot be empty").max(100).regex(/^[a-z0-9-]+$/,"buildkiteOrgSlug must be a lowercase Buildkite organisation slug"),agentTokenSsmParameterName:e.string().min(2).regex(/^\//,"agentTokenSsmParameterName must be a full path (leading /)").optional(),agentTokenKmsKeyArn:e.string().min(1).optional(),fjallApiKeySsmParameterName:e.string().min(2).regex(/^\//,"fjallApiKeySsmParameterName must be a full path (leading /)").optional(),instanceType:e.string().min(1).default("c8g.xlarge"),agentVolumeSizeGib:e.number().int().min(20).max(1e3).default(250),agentMinInstances:e.number().int().min(0).default(0),agentMaxInstances:e.number().int().min(1).default(2),agentsPerInstance:e.number().int().min(1).default(1),spotCapacityPercentage:e.number().int().min(0).max(100).default(0),scaleInIdlePeriodSeconds:e.number().int().min(60).default(600),disconnectAfterUptimeSeconds:e.number().int().min(3600).default(86400),maxInstanceLifetimeDays:e.number().int().min(1).max(365).default(7),terminateInstanceAfterJob:e.boolean().default(!1),purgeBuildsOnDiskFull:e.boolean().default(!0),terminateInstanceOnDiskFull:e.boolean().default(!1),logRetentionDays:e.number().int().min(1).default(30),agentLogRetentionDays:e.literal(s).default(7),buildkiteAgentRelease:e.enum(["stable","beta","edge"]).default("stable"),buildkiteAgentTags:e.string().default(""),buildkiteAgentTimestampLines:e.boolean().default(!1),buildkiteAgentExperiments:e.string().default(""),buildkiteAgentTracingBackend:e.enum(["","datadog","opentelemetry"]).default(""),buildkiteAgentCancelGracePeriodSeconds:e.number().int().min(10).default(60),enableSecretsPlugin:e.boolean().default(!0),enableEcrPlugin:e.boolean().default(!1),enableDockerLoginPlugin:e.boolean().default(!1),enableDockerUserNamespaceRemap:e.boolean().default(!0),enableDockerExperimental:e.boolean().default(!1),dockerNetworkingProtocol:e.enum(["ipv4","dualstack"]).default("ipv4"),enableInstanceStorage:e.boolean().default(!1),mountTmpfsAtTmp:e.boolean().default(!0),buildkiteAgentEnableGitMirrors:e.boolean().default(!1),bootstrapScriptUrl:e.string().default(""),agentEnvFileUrl:e.string().default(""),scalerEventSchedulePeriod:e.string().min(1).default("1 minute"),scalerMinPollInterval:e.string().min(1).default("10s"),scaleOutFactor:e.string().min(1).default("1.0"),scaleOutWaitingForJobs:e.boolean().default(!1),rolePermissionsBoundaryArn:e.string().min(1).optional(),alarmSnsTopicArn:e.string().min(1).optional(),applicationId:e.string().min(1).optional(),costAllocationEnvironment:e.string().min(1).optional(),costAllocationOwner:e.string().min(1).optional()}).strict(),u=o.refine(n=>n.agentMinInstances<=n.agentMaxInstances,{message:"agentMinInstances must be <= agentMaxInstances"});function g(n){const t=u.safeParse(n);if(!t.success){const l=t.error.issues.map(a=>`  - ${a.path.join(".")||"(root)"}: ${a.message}`).join(`
 `);throw new Error(`Buildkite: invalid props:
 ${l}`)}return t.data}i(g,"validateBuildkiteProps");export{o as BuildkitePropsObjectSchema,u as BuildkitePropsSchema,g as validateBuildkiteProps};

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",s="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function S(e){return`FjallDevDeploy${e}`}a(S,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",E="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function w(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t}=e,o={[`${t}:aud`]:s};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`,`org:${l}:dev-substrate-setup`]}}}]}a(w,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:s},StringLike:{[`${t}:sub`]:`org:${l}:dev:${o}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:r,sid:t,subject:o}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:s,[`${r}:sub`]:o}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsTaggedMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,E as DEV_SYNC_WRITER_POLICY_NAME,s as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,w as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,S as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};
+var n=Object.defineProperty;var a=(e,t)=>n(e,"name",{value:t,configurable:!0});const v="fjall.io",r="sts.amazonaws.com",S="0000000000000000000000000000000000000000";function A(e){return`FjallDevDeploy${e}`}a(A,"devDeployRoleName");function D(e){return`FjallDevProvisioner${e}`}a(D,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",w="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function u(e){return`arn:aws:iam::${e}:policy/${c}`}a(u,"devBoundaryPolicyArn");function d(e){return`org:${e}:dev-provisioner`}a(d,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function E(e){const{fjallOrgId:t,providerArn:s,issuerDomain:l}=e,o={[`${l}:aud`]:r};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:`org:${t}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:o,StringLike:{[`${l}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...o,[`${l}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}a(E,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:t,providerArn:s,issuerDomain:l,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:s},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${l}:aud`]:r},StringLike:{[`${l}:sub`]:`org:${t}:dev:${o}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:t,issuerDomain:s,sid:l,subject:o}=e;return[{Sid:l,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${s}:aud`]:r,[`${s}:sub`]:o}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:d(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function P(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(P,"buildDevSyncWriterTrustStatements");function b({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevPassSubstrateExecutionRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/FjallDev*Compute-DevSubstrate*`,Condition:{StringEquals:{"iam:PassedToService":"ecs-tasks.amazonaws.com"}}}]}a(b,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":u(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a($,"buildDevSyncWriterPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a(T,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,w as DEV_SYNC_WRITER_POLICY_NAME,r as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,S as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,T as buildDevBoundaryStatements,b as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,$ as buildDevSyncWriterPolicyStatements,P as buildDevSyncWriterTrustStatements,E as buildNarrowedDeployTrustStatements,u as devBoundaryPolicyArn,A as devDeployRoleName,D as devProvisionerRoleName,d as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "3.4.1";
+export declare const GENERATOR_VERSION = "3.5.2";

package/dist/src/version.js

@@ -1 +1 @@
-const E="3.4.1";export{E as GENERATOR_VERSION};
+const E="3.5.2";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "3.4.1",
+  "version": "3.5.2",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^3.4.1",
+    "@fjall/util": "^3.5.2",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "6d8ef9582d5abe6a8199431815dae761887c18d4"
+  "gitHead": "f59755647b2fd81ff692a3545e8e199d93c3bdf8"
 }