@fjall/generator 4.3.0 → 4.4.0

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-27T09:34:39.477Z
+146 files minified at 2026-07-30T00:34:10.939Z

package/dist/src/schemas/devRolePolicies.d.ts

@@ -113,6 +113,30 @@ export declare function devSyncSubject(fjallOrgId: string): string;
  * FjallMachineSubject statement, never by the user or service statements.
  */
 export declare function deployAccountSubject(fjallOrgId: string, awsAccountId: string): string;
+/**
+ * Generic machine subject — the shared literal every non-flipped machine mint
+ * issues and the pre-§4.4a trust accepts. Same cross-package coupled-value
+ * contract as {@link deployAccountSubject}: the webapp mint, the trust builder
+ * below, and the dev-gate trust probe must all route through THIS helper
+ * rather than re-deriving the string.
+ */
+export declare function genericMachineSubject(fjallOrgId: string): string;
+/**
+ * The service subjects the FjallDeploy trust accepts (see
+ * {@link buildNarrowedDeployTrustStatements} for why `dev-substrate-setup`
+ * rides the admin role). Single source for the vocabulary — consumers deriving
+ * runtime accept-sets or minting these subjects must use this tuple, never a
+ * re-listed copy.
+ */
+export declare const DEPLOY_SERVICE_SUBJECT_NAMES: readonly ["discovery", "connection", "org-setup", "dev-substrate-setup"];
+export type DeployServiceSubjectName = (typeof DEPLOY_SERVICE_SUBJECT_NAMES)[number];
+/**
+ * Server-minted service subject for the FjallDeploy-role service family.
+ * Coupled cross-package value ({@link deployAccountSubject} contract): the
+ * webapp's discovery credential provider and job handlers mint these exact
+ * strings.
+ */
+export declare function serviceSubject(fjallOrgId: string, service: DeployServiceSubjectName): string;
 /**
  * One statement of an OIDC federated trust (assume-role policy) document.
  * Distinct from `BoundaryStatement` because trust statements carry a
@@ -134,6 +158,20 @@ export interface OidcTrustParams {
     /** Issuer domain without scheme, e.g. `fjall.io`. */
     issuerDomain: string;
 }
+/**
+ * §4.4a machine-trust rendering mode for the FjallDeploy role.
+ *
+ * - `"expanded"` (default): governance renders `[generic, acct]` — a SUPERSET
+ *   of the pre-§4.4a trust, safe for every org because off-allowlist mints
+ *   still issue the generic subject.
+ * - `"account-scoped"` (Step-3 contract): the machine statement accepts ONLY
+ *   the account-scoped literal. Opt-in per deployment — NEVER the shared
+ *   default: issuance for most orgs still mints the generic subject, so a
+ *   default contract would lock their governance CI out at STS. Set it only
+ *   where per-account issuance is known-flipped (Fjall's own governance
+ *   accounts today; §4.4b's probe gate machine-sets it later).
+ */
+export type MachineTrustMode = "expanded" | "account-scoped";
 /**
  * Params for the narrowed FjallDeploy trust, with the optional §4.4a
  * governance-expand fields. A superset of {@link OidcTrustParams}: existing
@@ -155,6 +193,14 @@ export interface NarrowedDeployTrustParams extends OidcTrustParams {
      * unless `accountTier` is governance.
      */
     accountId?: string;
+    /**
+     * {@link MachineTrustMode}. Absent ⇒ `"expanded"`. `"account-scoped"`
+     * REQUIRES a governance `accountTier` and an `accountId` — anything else
+     * throws at synth rather than falling back to the generic literal (the
+     * expand-mode fail-safe inverts under contract: a silent generic fallback
+     * would re-widen the exact trust Step 3 exists to remove).
+     */
+    machineTrustMode?: MachineTrustMode;
 }
 /**
  * G4 narrowed trust for `FjallDeploy{orgId}` — replaces the single bare
@@ -180,6 +226,11 @@ export interface NarrowedDeployTrustParams extends OidcTrustParams {
  * absent tier renders the generic-only machine subject unchanged; a governance
  * tier WITHOUT `accountId` falls back to generic-only (fail-safe — never widen
  * to a bare wildcard we cannot bind to an account).
+ *
+ * §4.4a Step-3 contract: `machineTrustMode: "account-scoped"` renders the
+ * account-scoped literal ONLY (no generic member). Opt-in per deployment —
+ * see {@link MachineTrustMode} for why the shared default stays `"expanded"`
+ * and why misuse throws instead of falling back.
  */
 export declare function buildNarrowedDeployTrustStatements(params: NarrowedDeployTrustParams): OidcTrustStatement[];
 /**

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var g=Object.defineProperty;var a=(e,t)=>g(e,"name",{value:t,configurable:!0});import{isGovernanceTier as f}from"@fjall/util";const w="fjall.io",i="sts.amazonaws.com",E="0000000000000000000000000000000000000000";function p(e){return`FjallDevDeploy${e}`}a(p,"devDeployRoleName");function y(e){return`FjallDevProvisioner${e}`}a(y,"devProvisionerRoleName");function b(e){return`FjallDevSyncWriter${e}`}a(b,"devSyncWriterRoleName");const P="FjallDevDeployPolicy",F="FjallDevProvisionerPolicy",T="FjallDevSyncWriterPolicy",v="FjallDevBoundary";function S(e){return`arn:aws:iam::${e}:policy/${v}`}a(S,"devBoundaryPolicyArn");function A(e){return`org:${e}:dev-provisioner`}a(A,"devProvisionerSubject");function D(e){return`org:${e}:dev-sync`}a(D,"devSyncSubject");function m(e,t){return`org:${e}:acct:${t}`}a(m,"deployAccountSubject");function $(e){const{fjallOrgId:t,providerArn:o,issuerDomain:r,accountTier:l,accountId:n}=e,s={[`${r}:aud`]:i},c=`org:${t}:*`,d=l!==void 0&&f(l)&&n!==void 0?[c,m(t,n)]:c;return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${r}:sub`]:d}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${r}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${r}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}a($,"buildNarrowedDeployTrustStatements");function C(e){const{fjallOrgId:t,providerArn:o,issuerDomain:r,accountId:l}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:i},StringLike:{[`${r}:sub`]:`org:${t}:dev:${l}:*`}}}]}a(C,"buildDevDeployTrustStatements");function u(e){const{providerArn:t,issuerDomain:o,sid:r,subject:l}=e;return[{Sid:r,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${o}:aud`]:i,[`${o}:sub`]:l}}}]}a(u,"buildServiceSubjectTrustStatements");function L(e){return u({...e,sid:"FjallDevProvisionerSubject",subject:A(e.fjallOrgId)})}a(L,"buildDevProvisionerTrustStatements");function k(e){return u({...e,sid:"FjallDevSyncSubject",subject:D(e.fjallOrgId)})}a(k,"buildDevSyncWriterTrustStatements");function G({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(G,"buildDevDeployPolicyStatements");function x({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":S(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(x,"buildDevProvisionerPolicyStatements");function O({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(O,"buildDevSyncWriterPolicyStatements");function h({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a(h,"buildDevBoundaryStatements");export{v as DEV_BOUNDARY_POLICY_NAME,P as DEV_DEPLOY_POLICY_NAME,F as DEV_PROVISIONER_POLICY_NAME,T as DEV_SYNC_WRITER_POLICY_NAME,i as FJALL_OIDC_AUDIENCE,w as FJALL_OIDC_ISSUER_DOMAIN,E as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,h as buildDevBoundaryStatements,G as buildDevDeployPolicyStatements,C as buildDevDeployTrustStatements,x as buildDevProvisionerPolicyStatements,L as buildDevProvisionerTrustStatements,O as buildDevSyncWriterPolicyStatements,k as buildDevSyncWriterTrustStatements,$ as buildNarrowedDeployTrustStatements,m as deployAccountSubject,S as devBoundaryPolicyArn,p as devDeployRoleName,y as devProvisionerRoleName,A as devProvisionerSubject,D as devSyncSubject,b as devSyncWriterRoleName};
+var A=Object.defineProperty;var t=(e,a)=>A(e,"name",{value:a,configurable:!0});import{isGovernanceTier as u}from"@fjall/util";const y="fjall.io",c="sts.amazonaws.com",P="0000000000000000000000000000000000000000";function F(e){return`FjallDevDeploy${e}`}t(F,"devDeployRoleName");function T(e){return`FjallDevProvisioner${e}`}t(T,"devProvisionerRoleName");function $(e){return`FjallDevSyncWriter${e}`}t($,"devSyncWriterRoleName");const C="FjallDevDeployPolicy",k="FjallDevProvisionerPolicy",L="FjallDevSyncWriterPolicy",D="FjallDevBoundary";function m(e){return`arn:aws:iam::${e}:policy/${D}`}t(m,"devBoundaryPolicyArn");function R(e){return`org:${e}:dev-provisioner`}t(R,"devProvisionerSubject");function j(e){return`org:${e}:dev-sync`}t(j,"devSyncSubject");function d(e,a){return`org:${e}:acct:${a}`}t(d,"deployAccountSubject");function f(e){return`org:${e}:*`}t(f,"genericMachineSubject");const w=["discovery","connection","org-setup","dev-substrate-setup"];function E(e,a){return`org:${e}:${a}`}t(E,"serviceSubject");function h(e){const{fjallOrgId:a,providerArn:i,issuerDomain:r,accountTier:o,accountId:l}=e,v=e.machineTrustMode??"expanded",n={[`${r}:aud`]:c};let s;if(v==="account-scoped"){if(o===void 0||!u(o)||l===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(o)}, accountId ${l===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);s=[d(a,l)]}else o!==void 0&&u(o)&&l!==void 0?s=[f(a),d(a,l)]:s=f(a);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:s}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:n,StringLike:{[`${r}:sub`]:`org:${a}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:w.map(S=>E(a,S))}}}]}t(h,"buildNarrowedDeployTrustStatements");function x(e){const{fjallOrgId:a,providerArn:i,issuerDomain:r,accountId:o}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:i},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:c},StringLike:{[`${r}:sub`]:`org:${a}:dev:${o}:*`}}}]}t(x,"buildDevDeployTrustStatements");function g(e){const{providerArn:a,issuerDomain:i,sid:r,subject:o}=e;return[{Sid:r,Effect:"Allow",Principal:{Federated:a},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${i}:aud`]:c,[`${i}:sub`]:o}}}]}t(g,"buildServiceSubjectTrustStatements");function G(e){return g({...e,sid:"FjallDevProvisionerSubject",subject:R(e.fjallOrgId)})}t(G,"buildDevProvisionerTrustStatements");function O(e){return g({...e,sid:"FjallDevSyncSubject",subject:j(e.fjallOrgId)})}t(O,"buildDevSyncWriterTrustStatements");function q({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}t(q,"buildDevDeployPolicyStatements");function M({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":m(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}t(M,"buildDevProvisionerPolicyStatements");function _({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}t(_,"buildDevSyncWriterPolicyStatements");function W({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}t(W,"buildDevBoundaryStatements");export{w as DEPLOY_SERVICE_SUBJECT_NAMES,D as DEV_BOUNDARY_POLICY_NAME,C as DEV_DEPLOY_POLICY_NAME,k as DEV_PROVISIONER_POLICY_NAME,L as DEV_SYNC_WRITER_POLICY_NAME,c as FJALL_OIDC_AUDIENCE,y as FJALL_OIDC_ISSUER_DOMAIN,P as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,W as buildDevBoundaryStatements,q as buildDevDeployPolicyStatements,x as buildDevDeployTrustStatements,M as buildDevProvisionerPolicyStatements,G as buildDevProvisionerTrustStatements,_ as buildDevSyncWriterPolicyStatements,O as buildDevSyncWriterTrustStatements,h as buildNarrowedDeployTrustStatements,d as deployAccountSubject,m as devBoundaryPolicyArn,F as devDeployRoleName,T as devProvisionerRoleName,R as devProvisionerSubject,j as devSyncSubject,$ as devSyncWriterRoleName,f as genericMachineSubject,E as serviceSubject};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "4.3.0";
+export declare const GENERATOR_VERSION = "4.4.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="4.3.0";export{E as GENERATOR_VERSION};
+const E="4.4.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -48,7 +48,7 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^4.3.0",
+    "@fjall/util": "^4.4.0",
     "ast-types": "^0.16.1",
     "recast": "^0.23.11",
     "ts-morph": "^28.0.0",
@@ -64,5 +64,5 @@
     "typescript-eslint": "^8.59.1",
     "vitest": "^4.1.5"
   },
-  "gitHead": "8a3ae096f9d15c47dc8c277c9bddfa40e4168c19"
+  "gitHead": "c700128600ab453fa63ce28b3effe8965373be43"
 }