@fjall/generator 4.2.0 → 4.4.0

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-26T05:17:49.555Z
+146 files minified at 2026-07-30T00:34:10.939Z

package/dist/src/schemas/devRolePolicies.d.ts

@@ -1,3 +1,4 @@
+import { type AccountTier } from "@fjall/util";
 import { type BoundaryStatement } from "./securityBoundary.js";
 /**
  * Dev-tier IAM surface for the fast-dev-environments server-side gate
@@ -97,6 +98,45 @@ export declare function devBoundaryPolicyArn(accountId: string): string;
 export declare function devProvisionerSubject(fjallOrgId: string): string;
 /** Server-minted service subject for the §7 presigning sync-writer role. */
 export declare function devSyncSubject(fjallOrgId: string): string;
+/**
+ * Account-scoped machine subject (§4.4a) — the per-account literal a
+ * governance-tier mint issues in place of the generic `org:{orgId}:*`.
+ * `awsAccountId` is the 12-digit AWS account number, matching the OIDC mint's
+ * `awsAccountId` claim and the CDK `Stack.of(this).account`.
+ *
+ * Cross-package coupled value: the webapp OIDC mint MUST issue this exact
+ * shape, so both the trust builder (below) and the mint import THIS helper
+ * rather than re-deriving the string — a re-implementation would coincide for
+ * conforming inputs and drift silently at the edge (the same class the
+ * `toKebab`/ECR-repo rule guards). The `:acct:` segment is distinct from the
+ * `:user:`/`:dev:`/service subjects, so this literal is matched ONLY by the
+ * FjallMachineSubject statement, never by the user or service statements.
+ */
+export declare function deployAccountSubject(fjallOrgId: string, awsAccountId: string): string;
+/**
+ * Generic machine subject — the shared literal every non-flipped machine mint
+ * issues and the pre-§4.4a trust accepts. Same cross-package coupled-value
+ * contract as {@link deployAccountSubject}: the webapp mint, the trust builder
+ * below, and the dev-gate trust probe must all route through THIS helper
+ * rather than re-deriving the string.
+ */
+export declare function genericMachineSubject(fjallOrgId: string): string;
+/**
+ * The service subjects the FjallDeploy trust accepts (see
+ * {@link buildNarrowedDeployTrustStatements} for why `dev-substrate-setup`
+ * rides the admin role). Single source for the vocabulary — consumers deriving
+ * runtime accept-sets or minting these subjects must use this tuple, never a
+ * re-listed copy.
+ */
+export declare const DEPLOY_SERVICE_SUBJECT_NAMES: readonly ["discovery", "connection", "org-setup", "dev-substrate-setup"];
+export type DeployServiceSubjectName = (typeof DEPLOY_SERVICE_SUBJECT_NAMES)[number];
+/**
+ * Server-minted service subject for the FjallDeploy-role service family.
+ * Coupled cross-package value ({@link deployAccountSubject} contract): the
+ * webapp's discovery credential provider and job handlers mint these exact
+ * strings.
+ */
+export declare function serviceSubject(fjallOrgId: string, service: DeployServiceSubjectName): string;
 /**
  * One statement of an OIDC federated trust (assume-role policy) document.
  * Distinct from `BoundaryStatement` because trust statements carry a
@@ -118,6 +158,50 @@ export interface OidcTrustParams {
     /** Issuer domain without scheme, e.g. `fjall.io`. */
     issuerDomain: string;
 }
+/**
+ * §4.4a machine-trust rendering mode for the FjallDeploy role.
+ *
+ * - `"expanded"` (default): governance renders `[generic, acct]` — a SUPERSET
+ *   of the pre-§4.4a trust, safe for every org because off-allowlist mints
+ *   still issue the generic subject.
+ * - `"account-scoped"` (Step-3 contract): the machine statement accepts ONLY
+ *   the account-scoped literal. Opt-in per deployment — NEVER the shared
+ *   default: issuance for most orgs still mints the generic subject, so a
+ *   default contract would lock their governance CI out at STS. Set it only
+ *   where per-account issuance is known-flipped (Fjall's own governance
+ *   accounts today; §4.4b's probe gate machine-sets it later).
+ */
+export type MachineTrustMode = "expanded" | "account-scoped";
+/**
+ * Params for the narrowed FjallDeploy trust, with the optional §4.4a
+ * governance-expand fields. A superset of {@link OidcTrustParams}: existing
+ * callers that pass a plain `OidcTrustParams` render the unchanged
+ * generic-only machine subject (`accountTier`/`accountId` both absent).
+ */
+export interface NarrowedDeployTrustParams extends OidcTrustParams {
+    /**
+     * Account TIER (never the workload STAGE). When governance
+     * (`organisation`/`platform`) AND `accountId` is present, the machine-subject
+     * statement's accept list gains the account-scoped literal alongside the
+     * generic `org:{orgId}:*` (§4.4a expand). App-tier (`account`) or absent ⇒
+     * generic literal only (unchanged).
+     */
+    accountTier?: AccountTier;
+    /**
+     * 12-digit AWS account id of THIS account — the `{awsAccountId}` in the
+     * account-scoped machine subject ({@link deployAccountSubject}). Ignored
+     * unless `accountTier` is governance.
+     */
+    accountId?: string;
+    /**
+     * {@link MachineTrustMode}. Absent ⇒ `"expanded"`. `"account-scoped"`
+     * REQUIRES a governance `accountTier` and an `accountId` — anything else
+     * throws at synth rather than falling back to the generic literal (the
+     * expand-mode fail-safe inverts under contract: a silent generic fallback
+     * would re-widen the exact trust Step 3 exists to remove).
+     */
+    machineTrustMode?: MachineTrustMode;
+}
 /**
  * G4 narrowed trust for `FjallDeploy{orgId}` — replaces the single bare
  * `StringLike sub: org:{orgId}:*` (which matched EVERY subject including dev
@@ -131,8 +215,24 @@ export interface OidcTrustParams {
  * deliberate exception: substrate SETUP provisions CFN/Route53/Aurora/ECS the
  * scoped dev-tier roles AccessDeny, so it runs under the admin role like
  * `org-setup` (design "Deploy-role boundary" VERDICT-2).
+ *
+ * §4.4a governance-tier expand: when `accountTier` is governance
+ * (`organisation`/`platform`) AND `accountId` is present, the machine-subject
+ * statement additionally accepts the account-scoped literal
+ * `org:{orgId}:acct:{accountId}` ({@link deployAccountSubject}) — a SUPERSET of
+ * the prior trust (the generic `org:{orgId}:*` is retained), so this step never
+ * narrows on its own. Issuance flips to the account-scoped subject only after
+ * this expand is LIVE (design §4.2 invariant). App-tier (`account`) or an
+ * absent tier renders the generic-only machine subject unchanged; a governance
+ * tier WITHOUT `accountId` falls back to generic-only (fail-safe — never widen
+ * to a bare wildcard we cannot bind to an account).
+ *
+ * §4.4a Step-3 contract: `machineTrustMode: "account-scoped"` renders the
+ * account-scoped literal ONLY (no generic member). Opt-in per deployment —
+ * see {@link MachineTrustMode} for why the shared default stays `"expanded"`
+ * and why misuse throws instead of falling back.
  */
-export declare function buildNarrowedDeployTrustStatements(params: OidcTrustParams): OidcTrustStatement[];
+export declare function buildNarrowedDeployTrustStatements(params: NarrowedDeployTrustParams): OidcTrustStatement[];
 /**
  * Trust for `FjallDevDeploy{orgId}` — account-pinned: a bare `dev:*` would let
  * a token minted for dev account A assume the role in dev account B, silently

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var n=Object.defineProperty;var a=(e,l)=>n(e,"name",{value:l,configurable:!0});const v="fjall.io",o="sts.amazonaws.com",A="0000000000000000000000000000000000000000";function D(e){return`FjallDevDeploy${e}`}a(D,"devDeployRoleName");function S(e){return`FjallDevProvisioner${e}`}a(S,"devProvisionerRoleName");function m(e){return`FjallDevSyncWriter${e}`}a(m,"devSyncWriterRoleName");const R="FjallDevDeployPolicy",j="FjallDevProvisionerPolicy",w="FjallDevSyncWriterPolicy",c="FjallDevBoundary";function d(e){return`arn:aws:iam::${e}:policy/${c}`}a(d,"devBoundaryPolicyArn");function u(e){return`org:${e}:dev-provisioner`}a(u,"devProvisionerSubject");function g(e){return`org:${e}:dev-sync`}a(g,"devSyncSubject");function E(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t}=e,s={[`${t}:aud`]:o};return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${t}:sub`]:`org:${l}:*`}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${t}:sub`]:`org:${l}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${t}:sub`]:[`org:${l}:discovery`,`org:${l}:connection`,`org:${l}:org-setup`,`org:${l}:dev-substrate-setup`]}}}]}a(E,"buildNarrowedDeployTrustStatements");function p(e){const{fjallOrgId:l,providerArn:r,issuerDomain:t,accountId:s}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:r},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${t}:aud`]:o},StringLike:{[`${t}:sub`]:`org:${l}:dev:${s}:*`}}}]}a(p,"buildDevDeployTrustStatements");function i(e){const{providerArn:l,issuerDomain:r,sid:t,subject:s}=e;return[{Sid:t,Effect:"Allow",Principal:{Federated:l},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:o,[`${r}:sub`]:s}}}]}a(i,"buildServiceSubjectTrustStatements");function y(e){return i({...e,sid:"FjallDevProvisionerSubject",subject:u(e.fjallOrgId)})}a(y,"buildDevProvisionerTrustStatements");function b(e){return i({...e,sid:"FjallDevSyncSubject",subject:g(e.fjallOrgId)})}a(b,"buildDevSyncWriterTrustStatements");function P({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(P,"buildDevDeployPolicyStatements");function F({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":d(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(F,"buildDevProvisionerPolicyStatements");function T({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(T,"buildDevSyncWriterPolicyStatements");function $({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a($,"buildDevBoundaryStatements");export{c as DEV_BOUNDARY_POLICY_NAME,R as DEV_DEPLOY_POLICY_NAME,j as DEV_PROVISIONER_POLICY_NAME,w as DEV_SYNC_WRITER_POLICY_NAME,o as FJALL_OIDC_AUDIENCE,v as FJALL_OIDC_ISSUER_DOMAIN,A as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,$ as buildDevBoundaryStatements,P as buildDevDeployPolicyStatements,p as buildDevDeployTrustStatements,F as buildDevProvisionerPolicyStatements,y as buildDevProvisionerTrustStatements,T as buildDevSyncWriterPolicyStatements,b as buildDevSyncWriterTrustStatements,E as buildNarrowedDeployTrustStatements,d as devBoundaryPolicyArn,D as devDeployRoleName,S as devProvisionerRoleName,u as devProvisionerSubject,g as devSyncSubject,m as devSyncWriterRoleName};
+var A=Object.defineProperty;var t=(e,a)=>A(e,"name",{value:a,configurable:!0});import{isGovernanceTier as u}from"@fjall/util";const y="fjall.io",c="sts.amazonaws.com",P="0000000000000000000000000000000000000000";function F(e){return`FjallDevDeploy${e}`}t(F,"devDeployRoleName");function T(e){return`FjallDevProvisioner${e}`}t(T,"devProvisionerRoleName");function $(e){return`FjallDevSyncWriter${e}`}t($,"devSyncWriterRoleName");const C="FjallDevDeployPolicy",k="FjallDevProvisionerPolicy",L="FjallDevSyncWriterPolicy",D="FjallDevBoundary";function m(e){return`arn:aws:iam::${e}:policy/${D}`}t(m,"devBoundaryPolicyArn");function R(e){return`org:${e}:dev-provisioner`}t(R,"devProvisionerSubject");function j(e){return`org:${e}:dev-sync`}t(j,"devSyncSubject");function d(e,a){return`org:${e}:acct:${a}`}t(d,"deployAccountSubject");function f(e){return`org:${e}:*`}t(f,"genericMachineSubject");const w=["discovery","connection","org-setup","dev-substrate-setup"];function E(e,a){return`org:${e}:${a}`}t(E,"serviceSubject");function h(e){const{fjallOrgId:a,providerArn:i,issuerDomain:r,accountTier:o,accountId:l}=e,v=e.machineTrustMode??"expanded",n={[`${r}:aud`]:c};let s;if(v==="account-scoped"){if(o===void 0||!u(o)||l===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(o)}, accountId ${l===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);s=[d(a,l)]}else o!==void 0&&u(o)&&l!==void 0?s=[f(a),d(a,l)]:s=f(a);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:s}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:n,StringLike:{[`${r}:sub`]:`org:${a}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:w.map(S=>E(a,S))}}}]}t(h,"buildNarrowedDeployTrustStatements");function x(e){const{fjallOrgId:a,providerArn:i,issuerDomain:r,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:c},StringLike:{[`${r}:sub`]:`org:${a}:dev:${o}:*`}}}]}t(x,"buildDevDeployTrustStatements");function g(e){const{providerArn:a,issuerDomain:i,sid:r,subject:o}=e;return[{Sid:r,Effect:"Allow",Principal:{Federated:a},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:c,[`${i}:sub`]:o}}}]}t(g,"buildServiceSubjectTrustStatements");function G(e){return g({...e,sid:"FjallDevProvisionerSubject",subject:R(e.fjallOrgId)})}t(G,"buildDevProvisionerTrustStatements");function O(e){return g({...e,sid:"FjallDevSyncSubject",subject:j(e.fjallOrgId)})}t(O,"buildDevSyncWriterTrustStatements");function q({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}t(q,"buildDevDeployPolicyStatements");function M({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":m(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}t(M,"buildDevProvisionerPolicyStatements");function _({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}t(_,"buildDevSyncWriterPolicyStatements");function W({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}t(W,"buildDevBoundaryStatements");export{w as DEPLOY_SERVICE_SUBJECT_NAMES,D as DEV_BOUNDARY_POLICY_NAME,C as DEV_DEPLOY_POLICY_NAME,k as DEV_PROVISIONER_POLICY_NAME,L as DEV_SYNC_WRITER_POLICY_NAME,c as FJALL_OIDC_AUDIENCE,y as FJALL_OIDC_ISSUER_DOMAIN,P as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,W as buildDevBoundaryStatements,q as buildDevDeployPolicyStatements,x as buildDevDeployTrustStatements,M as buildDevProvisionerPolicyStatements,G as buildDevProvisionerTrustStatements,_ as buildDevSyncWriterPolicyStatements,O as buildDevSyncWriterTrustStatements,h as buildNarrowedDeployTrustStatements,d as deployAccountSubject,m as devBoundaryPolicyArn,F as devDeployRoleName,T as devProvisionerRoleName,R as devProvisionerSubject,j as devSyncSubject,$ as devSyncWriterRoleName,f as genericMachineSubject,E as serviceSubject};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "4.2.0";
+export declare const GENERATOR_VERSION = "4.4.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="4.2.0";export{E as GENERATOR_VERSION};
+const E="4.4.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "4.2.0",
+  "version": "4.4.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^4.2.0",
+    "@fjall/util": "^4.4.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "c06f7ad6b4b63a99cc8e2fcf4f216ff1c14748c6"
+  "gitHead": "c700128600ab453fa63ce28b3effe8965373be43"
 }