@fjall/generator 30.0.0 → 31.0.0

package/dist/.build-source-hash

@@ -9,7 +9,7 @@
     "package.json",
     "tsconfig.json"
   ],
-  "hash": "2cdc6fe6364ffca7659f2905b7e3efb325d995e5d44ad130ece892073f4aac34",
+  "hash": "f6fe0cf1bd62c37ef4f0bd6a7bdb0214ebec66f14fe6564df2548372a4e25ca8",
   "files": {
     "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
     "src/ast/domain/astDomainParser.ts": "12107a9864c6670c",
@@ -173,7 +173,7 @@
     "src/schemas/organisationSchemas.ts": "50d793aa7ff7f749",
     "src/schemas/patternSchemas.ts": "60a32bacaf767479",
     "src/schemas/resourceSchemas.ts": "cd050813242ea213",
-    "src/schemas/securityBoundary.ts": "54d216807103bab8",
+    "src/schemas/securityBoundary.ts": "ef3148c29d5d11f3",
     "src/schemas/sharedTypes.ts": "45210e600bea393e",
     "src/schemas/storageSchemas.ts": "2d4b9d86e3397387",
     "src/types/Result.ts": "6a078a91fc3072e3",
@@ -181,11 +181,11 @@
     "src/validation/patterns.ts": "f9629eafdad7ac3e",
     "src/validation/validationMessages.ts": "b03413b3953c3e79",
     "src/validation/validationPatterns.ts": "865f3d688975b7c8",
-    "src/version.ts": "2b53ee70cfa3c998",
+    "src/version.ts": "44796fa69ed21d3a",
     "../scripts/minify-dist.mjs": "6b2e4b0df8aec601",
-    "package.json": "0d9765f4ee24793d",
+    "package.json": "d78da7528d41e1e1",
     "tsconfig.json": "1929cf3f99fe9b1e"
   },
-  "outputHash": "2c7b712a79479ee7fd8b2f55ad95efb5f6c3d09c9f1052395ead03aeb8cff99e",
+  "outputHash": "49be50db43b701a3a7c54d94132304d0ecce076bc9c30df481ed694a87cce1e4",
   "outputFileCount": 343
 }

package/dist/.minified

@@ -1 +1 @@
-171 files minified at 2026-09-02T22:02:58.560Z
+171 files minified at 2026-09-03T09:13:58.800Z

package/dist/src/schemas/securityBoundary.d.ts

@@ -12,11 +12,13 @@ import { type GovernancePreset } from "./constants.js";
  * and per-tier STATEMENT CONTENT. It lives in `@fjall/generator` (not
  * `@fjall/util`) because it keys on `GovernancePreset`, which lives here — and
  * `@fjall/util` cannot import it without a circular dependency. Consumers:
- * `@fjall/components-infrastructure` (creates the policy in `oidcConnector.ts`),
+ * `@fjall/components-infrastructure` (renders the policy document into the
+ * `Custom::FjallDeployBoundary` singleton in `oidcConnector.ts`),
  * `@fjall/deploy-core` (passes the name to `cdk bootstrap`), `@fjall/cli`
  * (resolves the tier). The Quick-Create YAML twin mirrors the content by hand,
  * kept in lockstep by `oidcConnectorTemplate.test.ts` (presence parity + a
- * statement-content deep-compare against the hardened tier of this SSoT).
+ * statement-content deep-compare against this SSoT's
+ * `DEFAULT_DEPLOY_BOUNDARY_TIER`).
  *
  * NOT related to `PermissionsBoundarySpec` in organisationSchemas.ts — that is a
  * REFERENCE to an existing policy for Identity Centre permission sets; this
@@ -53,6 +55,63 @@ export interface BoundaryStatement {
  * (`CdkService.runCdkBootstrap` → `CdkOptions.permissionsBoundary`).
  */
 export declare function deployBoundaryName(fjallOrgId: string): string;
+/**
+ * IAM path of the OIDC deploy role. Load-bearing: the org SCP preset exempts
+ * `role/fjall/FjallDeploy*` from its protect-* denies BY PATH, so a
+ * member-account admin cannot forge an exempt `FjallDeploy*` role at the
+ * default path.
+ */
+export declare const DEPLOY_ROLE_PATH = "/fjall/";
+/**
+ * The OIDC deploy role's name — org-id-suffixed like the boundary it carries.
+ *
+ * COUPLED VALUE — the CDK construct that CREATES the role
+ * (`config/aws/oidcConnector.ts`), the SCP preset's exempt pattern
+ * (`config/aws/scpPreset.ts`) and `DEPLOY_BOUNDED_ROLE_ARN_PATTERNS` below
+ * all derive from here; the Quick-Create YAML twin
+ * (`!Sub "FjallDeploy${FjallOrgId}"`) mirrors it by hand, parity-pinned.
+ */
+export declare function deployRoleName(fjallOrgId: string): string;
+/**
+ * ARN shape of every org's deploy-boundary policy, any partition, any account
+ * — the resource the self-protection statements below key on. Derived from
+ * `deployBoundaryName` so a name change moves the protection with it.
+ */
+export declare const DEPLOY_BOUNDARY_POLICY_ARN_PATTERN: string;
+/**
+ * ARN shapes of the two admin surfaces whose boundary Fjall OWNS: the OIDC
+ * deploy role (`deployRoleName` under `DEPLOY_ROLE_PATH` — the derivation
+ * `oidcConnector.ts` renders, so a rename moves the protection with it) and
+ * the CDK bootstrap execution role
+ * (`cdk-<qualifier>-cfn-exec-role-<account>-<region>`, capped by seam 2).
+ * `FjallDenyBoundaryReplace` is scoped to these two, never `*`: CloudFormation
+ * emits `iam:PutRolePermissionsBoundary` when a customer stack UPDATES the
+ * boundary on one of its OWN roles (an org-mandated enterprise boundary), and a
+ * global deny would break that legitimate deploy. Revisit the scope when E3b
+ * bounds every CDK-created role with a Fjall policy — and note that a
+ * scope-only change to a statement (same Deny actions, wider Resource or a
+ * dropped Condition) is invisible to the singleton writer's loosening ratchet,
+ * which compares Deny ACTION sets (`deployBoundarySingleton.ts`): it lands as
+ * an ordinary tier rotation, so it needs the digest rotation, never a hand
+ * edit of the live policy.
+ */
+export declare const DEPLOY_BOUNDED_ROLE_ARN_PATTERNS: string[];
+/**
+ * The boundary CONTENT every renderer of the deploy surface ships when no
+ * governance tier is given — the default is a TIER, never "no boundary".
+ *
+ * COUPLED VALUE — three renderers MUST agree on it, or a CDK redeploy of a
+ * template-connected role silently loosens (or tightens) the ceiling the
+ * customer connected under: (1) the Quick-Create YAML twin, which has no tier
+ * parameter and hand-mirrors exactly this tier's statements (deep-compared by
+ * `oidcConnectorTemplate.test.ts`); (2) the CDK `OidcConnector`, which reads
+ * it when `securityTier` is absent; (3) the bootstrap seam, which caps the
+ * `cfn-exec-role` with whichever policy (1) or (2) created. `securityTier`
+ * selects different CONTENT; the `deployRoleBoundary: false` /
+ * `FjallPermissionsBoundary=false` knobs are the only way to render an
+ * unbounded role.
+ */
+export declare const DEFAULT_DEPLOY_BOUNDARY_TIER: GovernancePreset;
 /**
  * Tier → boundary statement list. `Record<GovernancePreset, …>` so a new tier
  * landing in `GOVERNANCE_PRESETS` lights up a missing-key `error TS2741` here —
@@ -65,16 +124,6 @@ export declare function deployBoundaryName(fjallOrgId: string): string;
  * (adversarial content review, aiDocs 2026-07-05-phase-e-deploy-boundary):
  *   • `iam:AttachRolePolicy` of `AdministratorAccess` — breaks bootstrap's
  *     creation of the cfn-exec-role (which carries AdministratorAccess).
- *   • `iam:PutRolePermissionsBoundary` [companion to FjallDenyBoundarySelfEscape]
- *     — the SECOND self-escape (replace own boundary with a permissive one).
- *     Emitted by re-bootstrap boundary UPDATE and by the deferred E3b path
- *     (cdk.json permissionsBoundary on app roles → CFN UPDATE of an existing
- *     role's boundary). Deny only once E3b resource-scopes it (allow when
- *     setting the Fjall boundary / exempt CDK-created role paths); hardened.
- *   • Boundary-policy self-protection (deny `iam:CreatePolicyVersion` /
- *     `iam:SetDefaultPolicyVersion` on the FjallDeployBoundary policy itself)
- *     — blocks the role republishing a permissive version of its own ceiling;
- *     requires out-of-band admin to re-tune, so land with the live loop.
  *   • `kms:PutKeyPolicy` — CFN emits it on key-policy/grant UPDATE (e.g.
  *     `key.grantDecrypt(newPrincipal)` on redeploy); denying outright breaks a
  *     legitimate app redeploy. Needs a live cycle or resource scoping.
@@ -91,6 +140,32 @@ export declare function deployBoundaryName(fjallOrgId: string): string;
  *     UpdateOrganizationConfiguration), but they fire only in a platform/org
  *     account; validate in a platform hardened cycle.
  *
+ * LANDED FROM THE CANDIDATE LIST (foundation, 31.0.0): the two companion
+ * self-escapes. `iam:PutRolePermissionsBoundary` on the two Fjall-bounded
+ * roles is denied only when the boundary being set is NOT a
+ * `FjallDeployBoundary*` policy (`FjallDenyBoundaryReplace`, an `ArnNotLike`
+ * condition on `iam:PermissionsBoundary`), so re-bootstrap's boundary UPDATE
+ * and the deferred E3b path — both of which set the Fjall boundary — stay
+ * allowed, and so does a customer stack putting its own boundary on its own
+ * roles. Create/re-version/delete of the boundary policy itself is denied
+ * outright (`FjallDenyBoundaryPolicyTamper`); the policy is written by the
+ * `Custom::FjallDeployBoundary` singleton handler — a bounded cfn-exec-role no
+ * longer creates or updates it natively — and that handler publishes only a
+ * document whose digest matches a tier below, so driving it with a crafted
+ * custom-resource event cannot loosen the ceiling either. Both denies are
+ * one-way for the bounded principal: re-tuning the ceiling is an out-of-band
+ * admin step (the handler converges the policy on the next connector deploy).
+ *
+ * HONEST CEILING. The boundary stops accidental and negligent CloudFormation
+ * actions and the direct self-edits above. It is NOT a hard cap against a
+ * hostile bounded session: the same AdministratorAccess-minus-denies session
+ * can still `iam:UpdateAssumeRolePolicy` + `sts:AssumeRole` an unbounded
+ * pre-existing role (OrganizationAccountAccessRole exists in every member
+ * account), or rewrite the singleton handler's code before the next deploy
+ * invokes it. Closing those needs the deferred E3b (boundary on every
+ * CDK-created role) plus role-immutability denies, which today would break
+ * bootstrap's creation of the cfn-exec-role — tracked, not built.
+ *
  * NEVER DENY (completeness review verified these are LOAD-BEARING — the org
  * security-services deploy CALLS them with AutoEnableOrganizationMembers:'ALL',
  * so denying breaks a legitimate platform-org deploy):

package/dist/src/schemas/securityBoundary.js

@@ -1 +1 @@
-var a=Object.defineProperty;var o=(e,t)=>a(e,"name",{value:t,configurable:!0});function r(e){return`FjallDeployBoundary${e}`}o(r,"deployBoundaryName");const n={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},c=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],i=[...c,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],l=[...i,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],D={foundation:[n,...c],compliance:[n,...i],hardened:[n,...l]};export{D as SECURITY_TIER_TO_BOUNDARY,r as deployBoundaryName};
+var r=Object.defineProperty;var o=(e,t)=>r(e,"name",{value:t,configurable:!0});function l(e){return`FjallDeployBoundary${e}`}o(l,"deployBoundaryName");const s="/fjall/";function D(e){return`FjallDeploy${e}`}o(D,"deployRoleName");const i=`arn:*:iam::*:policy/${l("*")}`,y=[`arn:*:iam::*:role${s}${D("*")}`,"arn:*:iam::*:role/cdk-*-cfn-exec-role-*"],n={Sid:"FjallInheritAdministratorAccess",Effect:"Allow",Action:"*",Resource:"*"},c=[{Sid:"FjallDenyOrgAndAccountEscape",Effect:"Deny",Action:["organizations:LeaveOrganization","account:CloseAccount"],Resource:"*"},{Sid:"FjallDenyDisableAuditLogging",Effect:"Deny",Action:["cloudtrail:StopLogging"],Resource:"*"},{Sid:"FjallDenyBoundarySelfEscape",Effect:"Deny",Action:["iam:DeleteRolePermissionsBoundary"],Resource:"*"},{Sid:"FjallDenyBoundaryReplace",Effect:"Deny",Action:["iam:PutRolePermissionsBoundary"],Resource:y,Condition:{ArnNotLike:{"iam:PermissionsBoundary":i}}},{Sid:"FjallDenyBoundaryPolicyTamper",Effect:"Deny",Action:["iam:CreatePolicy","iam:CreatePolicyVersion","iam:DeletePolicyVersion","iam:SetDefaultPolicyVersion","iam:DeletePolicy"],Resource:i},{Sid:"FjallDenyDisableKmsKey",Effect:"Deny",Action:["kms:DisableKey"],Resource:"*"}],a=[...c,{Sid:"FjallDenyStandingHumanCredentials",Effect:"Deny",Action:["iam:CreateUser","iam:CreateLoginProfile","iam:CreateAccessKey","iam:CreateAccountAlias"],Resource:"*"},{Sid:"FjallDenyDisableConfigRecorder",Effect:"Deny",Action:["config:StopConfigurationRecorder"],Resource:"*"}],d=[...a,{Sid:"FjallDenyAccountPasswordPolicyTamper",Effect:"Deny",Action:["iam:UpdateAccountPasswordPolicy","iam:DeleteAccountPasswordPolicy"],Resource:"*"},{Sid:"FjallDenyDisableDefaultEbsEncryption",Effect:"Deny",Action:["ec2:DisableEbsEncryptionByDefault"],Resource:"*"}],A="hardened",E={foundation:[n,...c],compliance:[n,...a],hardened:[n,...d]};export{A as DEFAULT_DEPLOY_BOUNDARY_TIER,i as DEPLOY_BOUNDARY_POLICY_ARN_PATTERN,y as DEPLOY_BOUNDED_ROLE_ARN_PATTERNS,s as DEPLOY_ROLE_PATH,E as SECURITY_TIER_TO_BOUNDARY,l as deployBoundaryName,D as deployRoleName};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "30.0.0";
+export declare const GENERATOR_VERSION = "31.0.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="30.0.0";export{E as GENERATOR_VERSION};
+const E="31.0.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "30.0.0",
+  "version": "31.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -58,7 +58,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
     "@babel/parser": "^7.29.8",
-    "@fjall/util": "^30.0.0",
+    "@fjall/util": "^31.0.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.12",
     "ts-morph": "^28.0.0",