@fjall/generator 4.3.0 → 5.0.0

package/dist/.build-source-hash

@@ -0,0 +1,156 @@
+{
+  "version": 1,
+  "algorithm": "sha256",
+  "sources": [
+    "src"
+  ],
+  "hash": "57a1628f8b57c0ec6e562cbb8d82160de330bd8409e1d9023a8bffb7198aaaa3",
+  "files": {
+    "src/ast/astTestHelpers.ts": "026cac849eb88bdb",
+    "src/ast/domain/astDomainParser.ts": "bac0b16eb2e62552",
+    "src/ast/index.ts": "502a507c3764acbf",
+    "src/ast/mutation/astCodeInjection.ts": "c1ebf483fb1e2332",
+    "src/ast/mutation/astExpressionEvaluator.ts": "6082789268b91212",
+    "src/ast/mutation/astSurgicalModification.ts": "9c512e11e8239c4d",
+    "src/ast/parsers/common/astCommonParser.ts": "d4c19453e9a75cac",
+    "src/ast/parsers/common/astStatementClassifier.ts": "b053f2ed51ec76f5",
+    "src/ast/parsers/common/astStatementQueries.ts": "e40e31e0fcdc15e3",
+    "src/ast/parsers/orchestrator/astInfrastructureParser.ts": "07fd7a94796ebf5f",
+    "src/ast/parsers/orchestrator/astPlanConverter.ts": "eb9b1f0ab90f6999",
+    "src/ast/parsers/resources/astCdnParser.ts": "e00d034378374811",
+    "src/ast/parsers/resources/astClickHouseParser.ts": "cf49943b3d2bbd48",
+    "src/ast/parsers/resources/astComputeConnectionParser.ts": "e0f1533845f3ce8a",
+    "src/ast/parsers/resources/astComputeParser.ts": "98e4a2e6b2d634fa",
+    "src/ast/parsers/resources/astComputeParserHelpers.ts": "6e0349d365bcf6cf",
+    "src/ast/parsers/resources/astDatabaseParser.ts": "e18f5483f5e23297",
+    "src/ast/parsers/resources/astDynamoDBParser.ts": "809c2c633447b388",
+    "src/ast/parsers/resources/astMessagingParser.ts": "b185ec22e6b96943",
+    "src/ast/parsers/resources/astNetworkParser.ts": "8697dccb454eac7d",
+    "src/ast/parsers/resources/astPatternParser.ts": "09c624247eaf0786",
+    "src/ast/parsers/resources/astScheduleParser.ts": "03de29da6d4b7380",
+    "src/ast/parsers/resources/astStorageParser.ts": "309bc3257f46cfdf",
+    "src/aws/regions.ts": "a028bcb92b0e41d9",
+    "src/codemod/_internal.ts": "e865b7172fcc457b",
+    "src/codemod/drift/detect.ts": "af3fb518a9d7165d",
+    "src/codemod/drift/index.ts": "e87e1ced35eefa44",
+    "src/codemod/drift/merge.ts": "29093929befa9abd",
+    "src/codemod/drift/snapshot.ts": "f8ef6b4097aa3d10",
+    "src/codemod/drift/types.ts": "7f1d7899e420e4d7",
+    "src/codemod/edits/addResource.ts": "002563615dbca570",
+    "src/codemod/edits/addResource/appBinding.ts": "20fe5dbcfdc378c3",
+    "src/codemod/edits/addResource/bodyIndex.ts": "3e179eac10d7bcf4",
+    "src/codemod/edits/addResource/propertyBuilder.ts": "18022f8899ba4b38",
+    "src/codemod/edits/appendAccountToStage.ts": "2b92f93734497303",
+    "src/codemod/edits/controlFlowPolicy.ts": "e32bbe2894f76c65",
+    "src/codemod/edits/crossPlanConnection.ts": "54a4ecb7b3368160",
+    "src/codemod/edits/driftPolicy.ts": "5d9b7bb3505f987d",
+    "src/codemod/edits/ensureImports.ts": "3ca0b6d446c4333c",
+    "src/codemod/edits/findInsertionPosition.ts": "20cd34fdcf781017",
+    "src/codemod/edits/index.ts": "bea5ed7c3983342b",
+    "src/codemod/edits/modifyResource.ts": "8b91e93dc9a732ec",
+    "src/codemod/edits/modifyResource/literalConversion.ts": "9a9eefbe72e434bf",
+    "src/codemod/edits/removeResource.ts": "2c7c8fe67bc3a866",
+    "src/codemod/edits/removeResource/commentHeuristic.ts": "90b6ce7ba5aa2a48",
+    "src/codemod/edits/removeResource/importPruning.ts": "f22783108b40f6cb",
+    "src/codemod/edits/unmanagedShapeErrors.ts": "4ea5a1614f8065f8",
+    "src/codemod/edits/vpcPeer.ts": "0bcf90c2e6d16ca4",
+    "src/codemod/edits/vpcPeerAccepter.ts": "c9eace933e9e2345",
+    "src/codemod/fileRewriter/builders.ts": "46a0d43240ff0818",
+    "src/codemod/fileRewriter/index.ts": "fd715b41176a7999",
+    "src/codemod/fileRewriter/locateByRange.ts": "889ee6256201c1fe",
+    "src/codemod/fileRewriter/parse.ts": "b12026c31562a13c",
+    "src/codemod/fileRewriter/print.ts": "f5ff7afb5b7786bf",
+    "src/codemod/historyPaths.ts": "ef8084013146db57",
+    "src/codemod/index.ts": "a555c237989cb6c4",
+    "src/codemod/listResources.ts": "97f206a50edbea20",
+    "src/codemod/llmFallback/apply.ts": "2e656a6e55b3b4e3",
+    "src/codemod/llmFallback/claudeTier.ts": "0a37fe782c85f75b",
+    "src/codemod/llmFallback/egressGate.ts": "2573dcf5b7a126a0",
+    "src/codemod/llmFallback/egressGate.types.ts": "15531dd497ae6135",
+    "src/codemod/llmFallback/index.ts": "b6c6cc8ef78d7887",
+    "src/codemod/llmFallback/morphTier.ts": "9551b6b63a1af561",
+    "src/codemod/llmFallback/prompt.ts": "60e8f4ab434bf9ec",
+    "src/codemod/llmFallback/runFallback.ts": "d3f1d1915aa56a23",
+    "src/codemod/llmFallback/shouldTryFallback.ts": "df6038f97612b8ee",
+    "src/codemod/llmFallback/signals.ts": "298bae6465b5f173",
+    "src/codemod/llmFallback/telemetryEvents.ts": "33a85939739693ab",
+    "src/codemod/llmFallback/tierRunner.ts": "a26094accd78cf15",
+    "src/codemod/llmFallback/types.ts": "14af8d2bd9afae12",
+    "src/codemod/registry.ts": "14b93cc476fdadd1",
+    "src/codemod/semanticIndex/classifyControlFlow.ts": "ed96215d91a3cae3",
+    "src/codemod/semanticIndex/findReferences.ts": "96aea37418d1e91a",
+    "src/codemod/semanticIndex/index.ts": "cfcd212d34ab20fb",
+    "src/codemod/semanticIndex/listImports.ts": "1e5fba6e34a17dab",
+    "src/codemod/semanticIndex/locateByShape.ts": "6c2eadd7d1df9464",
+    "src/codemod/semanticIndex/projectCache.ts": "dfd9b265c9d233c9",
+    "src/codemod/semanticIndex/resolveConstructByLiteralProperty.ts": "2d013a330af15c5c",
+    "src/codemod/telemetry/errorKinds.ts": "66c736abfa8b3a67",
+    "src/codemod/types.ts": "4097b650c1bde13a",
+    "src/codemod/validationGate/gates/classify.ts": "edb92a1f7a2d9aeb",
+    "src/codemod/validationGate/gates/drift.ts": "bd603a216fbb91a9",
+    "src/codemod/validationGate/gates/locate.ts": "2c186c32edbb97ce",
+    "src/codemod/validationGate/gates/parse.ts": "5433c5c8ffa35324",
+    "src/codemod/validationGate/gates/schema.ts": "aa904146e30219bd",
+    "src/codemod/validationGate/index.ts": "df5754bea9070410",
+    "src/codemod/validationGate/types.ts": "af466ee5f3433042",
+    "src/detection/index.ts": "b4ad9a935564cb3e",
+    "src/dns/bindParser.ts": "a5371cd1fa781ce6",
+    "src/dns/bindWriter.ts": "634b96dd15ee94b2",
+    "src/dns/domainFileGenerator.ts": "143fbcfbdb152398",
+    "src/dns/domainRecords.ts": "17f895ff9a7b719b",
+    "src/dns/index.ts": "b476ef3d7b381dc8",
+    "src/dns/types.ts": "82d6db9d7d26dbc2",
+    "src/generation/common.ts": "4b63724600c726de",
+    "src/generation/compute.ts": "4029a0d8e3197686",
+    "src/generation/compute/ec2.ts": "4d8187d293a57fb1",
+    "src/generation/compute/ecs.ts": "72190132fdaa1847",
+    "src/generation/compute/lambda.ts": "4f5e31080941b83a",
+    "src/generation/compute/shared.ts": "3724d4bfe92cfcb7",
+    "src/generation/database.ts": "a28f791f0f028343",
+    "src/generation/generatePatternCode.ts": "de16f42105a45358",
+    "src/generation/index.ts": "fd58a833e13bcf07",
+    "src/generation/infrastructure.ts": "6381d502f4733926",
+    "src/generation/messagingConnections.ts": "1f070088c39e9749",
+    "src/generation/storage.ts": "68fa78401bbcf8a5",
+    "src/generation/storageConnections.ts": "db1ab6ccdc19afab",
+    "src/index.ts": "fc8f27b8ffade9ef",
+    "src/planning/generateResourceChange.ts": "1c6411f9a12e7acb",
+    "src/planning/index.ts": "5caacb699eed31ba",
+    "src/planning/openNextPlanning.ts": "4af9cb9061f7d21e",
+    "src/planning/resourceAddition.ts": "45b010d2eaf96522",
+    "src/planning/resourceConnections.ts": "a6b7db8f733e560f",
+    "src/planning/resourcePlanning.ts": "85038ad65bda976f",
+    "src/planning/staticSitePlanning.ts": "242af1e9618821ab",
+    "src/presets/clickhouseTierPreset.ts": "72b2b8a8caf4bdb4",
+    "src/presets/index.ts": "8332c0198b2a6fe9",
+    "src/presets/patternTierPresets.ts": "f4fc368fc623aae4",
+    "src/presets/storagePresets.ts": "5df2d4d7d21a66d8",
+    "src/presets/tierPresets.ts": "c0148771bffbef9b",
+    "src/presets/tierTypes.ts": "96d33201ebddf6e6",
+    "src/schemas/alarmSchemas.ts": "9016095d8031f006",
+    "src/schemas/applicationSchemas.ts": "d85771a4607cf2da",
+    "src/schemas/baseSchemas.ts": "93d9bd1c0adfcaa0",
+    "src/schemas/buildkiteSchemas.ts": "a28ec3b40f7851ec",
+    "src/schemas/cdnSchemas.ts": "a982034c7903a31a",
+    "src/schemas/computeSchemas.ts": "516df862131921fe",
+    "src/schemas/constants.ts": "1df67cde0522a514",
+    "src/schemas/databaseSchemas.ts": "3c05f176e1aadb46",
+    "src/schemas/devRolePolicies.ts": "6ca70fb20f5fbebc",
+    "src/schemas/index.ts": "a1500a885048074b",
+    "src/schemas/instanceTypeArchitecture.ts": "6bf38031a54a4620",
+    "src/schemas/messagingSchemas.ts": "2c1975fac903fd1b",
+    "src/schemas/networkSchemas.ts": "c3a5f30e440dd2f8",
+    "src/schemas/organisationSchemas.ts": "50d793aa7ff7f749",
+    "src/schemas/patternSchemas.ts": "2ad2ed522c244ac1",
+    "src/schemas/resourceSchemas.ts": "cd050813242ea213",
+    "src/schemas/securityBoundary.ts": "54d216807103bab8",
+    "src/schemas/sharedTypes.ts": "45210e600bea393e",
+    "src/schemas/storageSchemas.ts": "2d4b9d86e3397387",
+    "src/types/Result.ts": "6a078a91fc3072e3",
+    "src/util/errorUtils.ts": "c021c57804424a5d",
+    "src/validation/patterns.ts": "f9629eafdad7ac3e",
+    "src/validation/validationMessages.ts": "c727ade4690274f4",
+    "src/validation/validationPatterns.ts": "865f3d688975b7c8",
+    "src/version.ts": "cf9b5c4290050e6f"
+  }
+}

package/dist/.minified

@@ -1 +1 @@
-146 files minified at 2026-07-27T09:34:39.477Z
+146 files minified at 2026-07-31T11:05:13.235Z

package/dist/src/dns/domainFileGenerator.js

@@ -24,7 +24,7 @@ ${l}  certificates: [
   ],
   records: ${d},
 });
-`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.260.0",constructs:"^10.6.0"}},null,2)+`
+`}r(k,"generateDefaultInfrastructureTs");function g(t){return JSON.stringify({name:`domain-${t}`,version:u,scripts:{},devDependencies:{"@types/node":"20.4.9","ts-node":"^10.9.1",typescript:"~5.1.6"},dependencies:{"@fjall/components-infrastructure":`^${u}`,"aws-cdk-lib":"^2.262.2",constructs:"^10.7.2"}},null,2)+`
 `}r(g,"generateDomainPackageJson");const y=`node_modules/
 cdk.out/
 *.d.ts

package/dist/src/schemas/devRolePolicies.d.ts

@@ -113,6 +113,30 @@ export declare function devSyncSubject(fjallOrgId: string): string;
  * FjallMachineSubject statement, never by the user or service statements.
  */
 export declare function deployAccountSubject(fjallOrgId: string, awsAccountId: string): string;
+/**
+ * Generic machine subject — the shared literal every non-flipped machine mint
+ * issues and the pre-§4.4a trust accepts. Same cross-package coupled-value
+ * contract as {@link deployAccountSubject}: the webapp mint, the trust builder
+ * below, and the dev-gate trust probe must all route through THIS helper
+ * rather than re-deriving the string.
+ */
+export declare function genericMachineSubject(fjallOrgId: string): string;
+/**
+ * The service subjects the FjallDeploy trust accepts (see
+ * {@link buildNarrowedDeployTrustStatements} for why `dev-substrate-setup`
+ * rides the admin role). Single source for the vocabulary — consumers deriving
+ * runtime accept-sets or minting these subjects must use this tuple, never a
+ * re-listed copy.
+ */
+export declare const DEPLOY_SERVICE_SUBJECT_NAMES: readonly ["discovery", "connection", "org-setup", "dev-substrate-setup"];
+export type DeployServiceSubjectName = (typeof DEPLOY_SERVICE_SUBJECT_NAMES)[number];
+/**
+ * Server-minted service subject for the FjallDeploy-role service family.
+ * Coupled cross-package value ({@link deployAccountSubject} contract): the
+ * webapp's discovery credential provider and job handlers mint these exact
+ * strings.
+ */
+export declare function serviceSubject(fjallOrgId: string, service: DeployServiceSubjectName): string;
 /**
  * One statement of an OIDC federated trust (assume-role policy) document.
  * Distinct from `BoundaryStatement` because trust statements carry a
@@ -134,6 +158,21 @@ export interface OidcTrustParams {
     /** Issuer domain without scheme, e.g. `fjall.io`. */
     issuerDomain: string;
 }
+/**
+ * §4.4a machine-trust rendering mode for the FjallDeploy role.
+ *
+ * - `"expanded"` (default): the machine accept list renders `[generic, acct]`
+ *   wherever the account id is known — a SUPERSET of the pre-§4.4a trust,
+ *   safe for every org because off-allowlist mints still issue the generic
+ *   subject (governance tiers since §4.4a; every tier since §4.4b Step 1).
+ * - `"account-scoped"` (Step-3 contract): the machine statement accepts ONLY
+ *   the account-scoped literal. Opt-in per deployment — NEVER the shared
+ *   default: issuance for most orgs still mints the generic subject, so a
+ *   default contract would lock their governance CI out at STS. Set it only
+ *   where per-account issuance is known-flipped (Fjall's own governance
+ *   accounts today; §4.4b's probe gate machine-sets it later).
+ */
+export type MachineTrustMode = "expanded" | "account-scoped";
 /**
  * Params for the narrowed FjallDeploy trust, with the optional §4.4a
  * governance-expand fields. A superset of {@link OidcTrustParams}: existing
@@ -142,19 +181,28 @@ export interface OidcTrustParams {
  */
 export interface NarrowedDeployTrustParams extends OidcTrustParams {
     /**
-     * Account TIER (never the workload STAGE). When governance
-     * (`organisation`/`platform`) AND `accountId` is present, the machine-subject
-     * statement's accept list gains the account-scoped literal alongside the
-     * generic `org:{orgId}:*` (§4.4a expand). App-tier (`account`) or absent ⇒
-     * generic literal only (unchanged).
+     * Account TIER (never the workload STAGE). Gates ONLY the
+     * `"account-scoped"` contract mode, which stays restricted to governance
+     * tiers (`organisation`/`platform`) until §4.4b's probe gate lands. The
+     * expand itself keys on `accountId` alone (§4.4b Step 1).
      */
     accountTier?: AccountTier;
     /**
      * 12-digit AWS account id of THIS account — the `{awsAccountId}` in the
-     * account-scoped machine subject ({@link deployAccountSubject}). Ignored
-     * unless `accountTier` is governance.
+     * account-scoped machine subject ({@link deployAccountSubject}). When
+     * present, the machine accept list gains the account-scoped literal
+     * alongside the generic sentinel (expand); absent ⇒ generic-only
+     * (fail-safe — never widen to a wildcard we cannot bind to an account).
      */
     accountId?: string;
+    /**
+     * {@link MachineTrustMode}. Absent ⇒ `"expanded"`. `"account-scoped"`
+     * REQUIRES a governance `accountTier` and an `accountId` — anything else
+     * throws at synth rather than falling back to the generic literal (the
+     * expand-mode fail-safe inverts under contract: a silent generic fallback
+     * would re-widen the exact trust Step 3 exists to remove).
+     */
+    machineTrustMode?: MachineTrustMode;
 }
 /**
  * G4 narrowed trust for `FjallDeploy{orgId}` — replaces the single bare
@@ -170,16 +218,20 @@ export interface NarrowedDeployTrustParams extends OidcTrustParams {
  * scoped dev-tier roles AccessDeny, so it runs under the admin role like
  * `org-setup` (design "Deploy-role boundary" VERDICT-2).
  *
- * §4.4a governance-tier expand: when `accountTier` is governance
- * (`organisation`/`platform`) AND `accountId` is present, the machine-subject
+ * §4.4a/§4.4b expand: when `accountId` is present the machine-subject
  * statement additionally accepts the account-scoped literal
  * `org:{orgId}:acct:{accountId}` ({@link deployAccountSubject}) — a SUPERSET of
  * the prior trust (the generic `org:{orgId}:*` is retained), so this step never
  * narrows on its own. Issuance flips to the account-scoped subject only after
- * this expand is LIVE (design §4.2 invariant). App-tier (`account`) or an
- * absent tier renders the generic-only machine subject unchanged; a governance
- * tier WITHOUT `accountId` falls back to generic-only (fail-safe — never widen
- * to a bare wildcard we cannot bind to an account).
+ * this expand is LIVE (design §4.2 invariant): governance issuance flipped
+ * with §4.4a; app-tier issuance stays generic until the §4.4b flip. An absent
+ * `accountId` renders the generic-only machine subject unchanged (fail-safe —
+ * never widen to a bare wildcard we cannot bind to an account).
+ *
+ * §4.4a Step-3 contract: `machineTrustMode: "account-scoped"` renders the
+ * account-scoped literal ONLY (no generic member). Opt-in per deployment —
+ * see {@link MachineTrustMode} for why the shared default stays `"expanded"`
+ * and why misuse throws instead of falling back.
  */
 export declare function buildNarrowedDeployTrustStatements(params: NarrowedDeployTrustParams): OidcTrustStatement[];
 /**

package/dist/src/schemas/devRolePolicies.js

@@ -1 +1 @@
-var g=Object.defineProperty;var a=(e,t)=>g(e,"name",{value:t,configurable:!0});import{isGovernanceTier as f}from"@fjall/util";const w="fjall.io",i="sts.amazonaws.com",E="0000000000000000000000000000000000000000";function p(e){return`FjallDevDeploy${e}`}a(p,"devDeployRoleName");function y(e){return`FjallDevProvisioner${e}`}a(y,"devProvisionerRoleName");function b(e){return`FjallDevSyncWriter${e}`}a(b,"devSyncWriterRoleName");const P="FjallDevDeployPolicy",F="FjallDevProvisionerPolicy",T="FjallDevSyncWriterPolicy",v="FjallDevBoundary";function S(e){return`arn:aws:iam::${e}:policy/${v}`}a(S,"devBoundaryPolicyArn");function A(e){return`org:${e}:dev-provisioner`}a(A,"devProvisionerSubject");function D(e){return`org:${e}:dev-sync`}a(D,"devSyncSubject");function m(e,t){return`org:${e}:acct:${t}`}a(m,"deployAccountSubject");function $(e){const{fjallOrgId:t,providerArn:o,issuerDomain:r,accountTier:l,accountId:n}=e,s={[`${r}:aud`]:i},c=`org:${t}:*`,d=l!==void 0&&f(l)&&n!==void 0?[c,m(t,n)]:c;return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${r}:sub`]:d}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:s,StringLike:{[`${r}:sub`]:`org:${t}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...s,[`${r}:sub`]:[`org:${t}:discovery`,`org:${t}:connection`,`org:${t}:org-setup`,`org:${t}:dev-substrate-setup`]}}}]}a($,"buildNarrowedDeployTrustStatements");function C(e){const{fjallOrgId:t,providerArn:o,issuerDomain:r,accountId:l}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:i},StringLike:{[`${r}:sub`]:`org:${t}:dev:${l}:*`}}}]}a(C,"buildDevDeployTrustStatements");function u(e){const{providerArn:t,issuerDomain:o,sid:r,subject:l}=e;return[{Sid:r,Effect:"Allow",Principal:{Federated:t},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${o}:aud`]:i,[`${o}:sub`]:l}}}]}a(u,"buildServiceSubjectTrustStatements");function L(e){return u({...e,sid:"FjallDevProvisionerSubject",subject:A(e.fjallOrgId)})}a(L,"buildDevProvisionerTrustStatements");function k(e){return u({...e,sid:"FjallDevSyncSubject",subject:D(e.fjallOrgId)})}a(k,"buildDevSyncWriterTrustStatements");function G({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}a(G,"buildDevDeployPolicyStatements");function x({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":S(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}a(x,"buildDevProvisionerPolicyStatements");function O({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}a(O,"buildDevSyncWriterPolicyStatements");function h({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}a(h,"buildDevBoundaryStatements");export{v as DEV_BOUNDARY_POLICY_NAME,P as DEV_DEPLOY_POLICY_NAME,F as DEV_PROVISIONER_POLICY_NAME,T as DEV_SYNC_WRITER_POLICY_NAME,i as FJALL_OIDC_AUDIENCE,w as FJALL_OIDC_ISSUER_DOMAIN,E as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,h as buildDevBoundaryStatements,G as buildDevDeployPolicyStatements,C as buildDevDeployTrustStatements,x as buildDevProvisionerPolicyStatements,L as buildDevProvisionerTrustStatements,O as buildDevSyncWriterPolicyStatements,k as buildDevSyncWriterTrustStatements,$ as buildNarrowedDeployTrustStatements,m as deployAccountSubject,S as devBoundaryPolicyArn,p as devDeployRoleName,y as devProvisionerRoleName,A as devProvisionerSubject,D as devSyncSubject,b as devSyncWriterRoleName};
+var S=Object.defineProperty;var t=(e,a)=>S(e,"name",{value:a,configurable:!0});import{isGovernanceTier as A}from"@fjall/util";const y="fjall.io",c="sts.amazonaws.com",P="0000000000000000000000000000000000000000";function F(e){return`FjallDevDeploy${e}`}t(F,"devDeployRoleName");function T(e){return`FjallDevProvisioner${e}`}t(T,"devProvisionerRoleName");function $(e){return`FjallDevSyncWriter${e}`}t($,"devSyncWriterRoleName");const C="FjallDevDeployPolicy",k="FjallDevProvisionerPolicy",L="FjallDevSyncWriterPolicy",D="FjallDevBoundary";function m(e){return`arn:aws:iam::${e}:policy/${D}`}t(m,"devBoundaryPolicyArn");function R(e){return`org:${e}:dev-provisioner`}t(R,"devProvisionerSubject");function j(e){return`org:${e}:dev-sync`}t(j,"devSyncSubject");function u(e,a){return`org:${e}:acct:${a}`}t(u,"deployAccountSubject");function d(e){return`org:${e}:*`}t(d,"genericMachineSubject");const w=["discovery","connection","org-setup","dev-substrate-setup"];function E(e,a){return`org:${e}:${a}`}t(E,"serviceSubject");function h(e){const{fjallOrgId:a,providerArn:o,issuerDomain:r,accountTier:i,accountId:l}=e,g=e.machineTrustMode??"expanded",n={[`${r}:aud`]:c};let s;if(g==="account-scoped"){if(i===void 0||!A(i)||l===void 0)throw new Error(`machineTrustMode "account-scoped" requires a governance accountTier and an accountId (got tier: ${String(i)}, accountId ${l===void 0?"absent":"present"}) \u2014 refusing to fall back to the generic machine subject: a silent fallback would re-widen the trust the \xA74.4a Step-3 contract removes`);s=[u(a,l)]}else l!==void 0?s=[d(a),u(a,l)]:s=d(a);return[{Sid:"FjallMachineSubject",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:s}}},{Sid:"FjallUserSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:n,StringLike:{[`${r}:sub`]:`org:${a}:user:*`}}},{Sid:"FjallServiceSubjects",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{...n,[`${r}:sub`]:w.map(v=>E(a,v))}}}]}t(h,"buildNarrowedDeployTrustStatements");function x(e){const{fjallOrgId:a,providerArn:o,issuerDomain:r,accountId:i}=e;return[{Sid:"FjallDevSubjectsThisAccount",Effect:"Allow",Principal:{Federated:o},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${r}:aud`]:c},StringLike:{[`${r}:sub`]:`org:${a}:dev:${i}:*`}}}]}t(x,"buildDevDeployTrustStatements");function f(e){const{providerArn:a,issuerDomain:o,sid:r,subject:i}=e;return[{Sid:r,Effect:"Allow",Principal:{Federated:a},Action:"sts:AssumeRoleWithWebIdentity",Condition:{StringEquals:{[`${o}:aud`]:c,[`${o}:sub`]:i}}}]}t(f,"buildServiceSubjectTrustStatements");function G(e){return f({...e,sid:"FjallDevProvisionerSubject",subject:R(e.fjallOrgId)})}t(G,"buildDevProvisionerTrustStatements");function O(e){return f({...e,sid:"FjallDevSyncSubject",subject:j(e.fjallOrgId)})}t(O,"buildDevSyncWriterTrustStatements");function q({accountId:e}){return[{Sid:"FjallDevEcsTaggedMutations",Effect:"Allow",Action:["ecs:UpdateService","ecs:DeleteService","ecs:RunTask","ecs:StopTask"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTaggedCreates",Effect:"Allow",Action:["ecs:RegisterTaskDefinition","ecs:CreateService"],Resource:"*",Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevEcsTagOnCreate",Effect:"Allow",Action:["ecs:TagResource"],Resource:`arn:aws:ecs:*:${e}:*`,Condition:{StringEquals:{"ecs:CreateAction":["RegisterTaskDefinition","CreateService","RunTask"]}}},{Sid:"FjallDevEcsReads",Effect:"Allow",Action:["ecs:Describe*","ecs:List*"],Resource:"*"},{Sid:"FjallDevEcsDeregisterTaskDefinition",Effect:"Allow",Action:["ecs:DeregisterTaskDefinition"],Resource:`arn:aws:ecs:*:${e}:task-definition/fjall-dev-*`},{Sid:"FjallDevElbTaggedMutations",Effect:"Allow",Action:["elasticloadbalancing:ModifyRule","elasticloadbalancing:DeleteRule","elasticloadbalancing:ModifyTargetGroup","elasticloadbalancing:ModifyTargetGroupAttributes","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:RegisterTargets","elasticloadbalancing:DeregisterTargets"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTaggedCreates",Effect:"Allow",Action:["elasticloadbalancing:CreateTargetGroup","elasticloadbalancing:CreateRule"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevElbTagOnCreate",Effect:"Allow",Action:["elasticloadbalancing:AddTags"],Resource:`arn:aws:elasticloadbalancing:*:${e}:*`,Condition:{StringEquals:{"elasticloadbalancing:CreateAction":["CreateTargetGroup","CreateRule"]}}},{Sid:"FjallDevElbReads",Effect:"Allow",Action:["elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevSsmDevTree",Effect:"Allow",Action:["ssm:GetParameter*","ssm:PutParameter","ssm:AddTagsToResource"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevLogsMutations",Effect:"Allow",Action:["logs:PutRetentionPolicy","logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsTaggedCreate",Effect:"Allow",Action:["logs:CreateLogGroup","logs:TagResource"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`,Condition:{StringEquals:{"aws:RequestTag/fjall:dev":"true"}}},{Sid:"FjallDevLogsRead",Effect:"Allow",Action:["logs:GetLogEvents","logs:DescribeLogStreams","logs:FilterLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevLogsDescribeGroups",Effect:"Allow",Action:["logs:DescribeLogGroups"],Resource:"*"},{Sid:"FjallDevKmsViaDevAlias",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevKmsSsmSecureString",Effect:"Allow",Action:["kms:Encrypt","kms:Decrypt","kms:GenerateDataKey"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}},{Sid:"FjallDevEcrAuthToken",Effect:"Allow",Action:["ecr:GetAuthorizationToken"],Resource:"*"},{Sid:"FjallDevEcrPushPull",Effect:"Allow",Action:["ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload","ecr:BatchCheckLayerAvailability","ecr:BatchGetImage","ecr:GetDownloadUrlForLayer","ecr:DescribeImages"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevPassDevPathRoles",Effect:"Allow",Action:["iam:PassRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`}]}t(q,"buildDevDeployPolicyStatements");function M({accountId:e}){return[{Sid:"FjallDevProvisionerBoundedRoleWrites",Effect:"Allow",Action:["iam:CreateRole","iam:PutRolePolicy","iam:AttachRolePolicy"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`,Condition:{StringEquals:{"iam:PermissionsBoundary":m(e)}}},{Sid:"FjallDevProvisionerPathRoleOps",Effect:"Allow",Action:["iam:DeleteRole","iam:DeleteRolePolicy","iam:DetachRolePolicy","iam:ListRolePolicies","iam:TagRole"],Resource:`arn:aws:iam::${e}:role/fjall/dev/*`},{Sid:"FjallDevProvisionerListRoles",Effect:"Allow",Action:["iam:ListRoles"],Resource:"*"},{Sid:"FjallDevProvisionerDevMasterSecrets",Effect:"Allow",Action:["secretsmanager:GetSecretValue"],Resource:`arn:aws:secretsmanager:*:${e}:secret:fjall-dev-*`},{Sid:"FjallDevProvisionerKmsDecryptViaSecretsManager",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"secretsmanager.*.amazonaws.com"}}},{Sid:"FjallDevProvisionerDataApi",Effect:"Allow",Action:["rds-data:ExecuteStatement","rds-data:BatchExecuteStatement","rds-data:BeginTransaction","rds-data:CommitTransaction","rds-data:RollbackTransaction"],Resource:`arn:aws:rds:*:${e}:cluster:fjall-dev-*`},{Sid:"FjallDevProvisionerMetrics",Effect:"Allow",Action:["cloudwatch:GetMetricData"],Resource:"*"},{Sid:"FjallDevProvisionerOrphanDiscovery",Effect:"Allow",Action:["tag:GetResources"],Resource:"*"},{Sid:"FjallDevProvisionerSsmTeardown",Effect:"Allow",Action:["ssm:DeleteParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevProvisionerLogsTeardown",Effect:"Allow",Action:["logs:DeleteLogGroup"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevProvisionerTaggedTeardown",Effect:"Allow",Action:["ecs:UpdateService","ecs:StopTask","ecs:DeleteService","elasticloadbalancing:DeleteRule","elasticloadbalancing:DeleteTargetGroup","elasticloadbalancing:DeregisterTargets"],Resource:[`arn:aws:ecs:*:${e}:*`,`arn:aws:elasticloadbalancing:*:${e}:*`],Condition:{StringEquals:{"aws:ResourceTag/fjall:dev":"true"}}},{Sid:"FjallDevProvisionerTeardownReads",Effect:"Allow",Action:["ecs:Describe*","elasticloadbalancing:Describe*"],Resource:"*"},{Sid:"FjallDevProvisionerImageJanitor",Effect:"Allow",Action:["ecr:ListImages","ecr:DescribeImages","ecr:BatchDeleteImage"],Resource:`arn:aws:ecr:*:${e}:repository/*`},{Sid:"FjallDevProvisionerSsmReadAll",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/*`},{Sid:"FjallDevProvisionerKmsDecryptViaSsm",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{StringLike:{"kms:ViaService":"ssm.*.amazonaws.com"}}}]}t(M,"buildDevProvisionerPolicyStatements");function _({accountId:e}){return[{Sid:"FjallDevSyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}}]}t(_,"buildDevSyncWriterPolicyStatements");function W({accountId:e}){return[{Sid:"FjallDevBoundarySsmDevRead",Effect:"Allow",Action:["ssm:GetParameter*"],Resource:`arn:aws:ssm:*:${e}:parameter/fjall/dev/*`},{Sid:"FjallDevBoundaryKmsDecryptDevAlias",Effect:"Allow",Action:["kms:Decrypt"],Resource:`arn:aws:kms:*:${e}:key/*`,Condition:{"ForAnyValue:StringLike":{"kms:ResourceAliases":"alias/fjall-dev-*"}}},{Sid:"FjallDevBoundarySyncPrefixReadWrite",Effect:"Allow",Action:["s3:GetObject","s3:PutObject"],Resource:`arn:aws:s3:::fjall-dev-sync-${e}-*/*`,Condition:{StringEquals:{"aws:ResourceAccount":e}}},{Sid:"FjallDevBoundarySlotLogs",Effect:"Allow",Action:["logs:CreateLogStream","logs:PutLogEvents"],Resource:`arn:aws:logs:*:${e}:log-group:/fjall/dev/*`},{Sid:"FjallDevBoundarySyncQueue",Effect:"Allow",Action:["sqs:ReceiveMessage","sqs:DeleteMessage","sqs:GetQueueUrl"],Resource:`arn:aws:sqs:*:${e}:fjall-dev-sync-${e}-*`}]}t(W,"buildDevBoundaryStatements");export{w as DEPLOY_SERVICE_SUBJECT_NAMES,D as DEV_BOUNDARY_POLICY_NAME,C as DEV_DEPLOY_POLICY_NAME,k as DEV_PROVISIONER_POLICY_NAME,L as DEV_SYNC_WRITER_POLICY_NAME,c as FJALL_OIDC_AUDIENCE,y as FJALL_OIDC_ISSUER_DOMAIN,P as FJALL_OIDC_PLACEHOLDER_THUMBPRINT,W as buildDevBoundaryStatements,q as buildDevDeployPolicyStatements,x as buildDevDeployTrustStatements,M as buildDevProvisionerPolicyStatements,G as buildDevProvisionerTrustStatements,_ as buildDevSyncWriterPolicyStatements,O as buildDevSyncWriterTrustStatements,h as buildNarrowedDeployTrustStatements,u as deployAccountSubject,m as devBoundaryPolicyArn,F as devDeployRoleName,T as devProvisionerRoleName,R as devProvisionerSubject,j as devSyncSubject,$ as devSyncWriterRoleName,d as genericMachineSubject,E as serviceSubject};

package/dist/src/schemas/instanceTypeArchitecture.js

@@ -1 +1 @@
-var n=Object.defineProperty;var c=(t,e)=>n(t,"name",{value:e,configurable:!0});const i=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","m6g","m6gd","m7g","m7gd","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function g(t){const e=t.split(".")[0]??"";return i.has(e)?"ARM":"STANDARD"}c(g,"getArchitectureForInstanceType");function a(t,e){const r=g(t);return r!==e?{valid:!1,message:`Instance type '${t}' requires ${r} architecture, but '${e}' AMI was specified. Use a ${r==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}c(a,"validateArchitectureMatch");function o(t,e){return g(t)===e}c(o,"isArchitectureCompatible");export{g as getArchitectureForInstanceType,o as isArchitectureCompatible,a as validateArchitectureMatch};
+var n=Object.defineProperty;var g=(t,e)=>n(t,"name",{value:e,configurable:!0});const i=new Set(["t4g","c6g","c6gd","c6gn","c7g","c7gd","c7gn","r6g","r6gd","r7g","r7gd","r8g","r8gd","c8g","c8gd","c8gn","m6g","m6gd","m7g","m7gd","m8g","m8gd","x8g","i8g","a1","x2gd","im4gn","is4gen","i4g","hpc7g"]);function r(t){const e=t.split(".")[0]??"";return i.has(e)?"ARM":"STANDARD"}g(r,"getArchitectureForInstanceType");function a(t,e){const c=r(t);return c!==e?{valid:!1,message:`Instance type '${t}' requires ${c} architecture, but '${e}' AMI was specified. Use a ${c==="ARM"?"Graviton instance (t4g, c6g, r6g, m6g, etc.)":"Intel/AMD instance (t3, c5, r5, m5, etc.)"} instead.`}:{valid:!0}}g(a,"validateArchitectureMatch");function d(t,e){return r(t)===e}g(d,"isArchitectureCompatible");export{r as getArchitectureForInstanceType,d as isArchitectureCompatible,a as validateArchitectureMatch};

package/dist/src/version.d.ts

@@ -1 +1 @@
-export declare const GENERATOR_VERSION = "4.3.0";
+export declare const GENERATOR_VERSION = "5.0.0";

package/dist/src/version.js

@@ -1 +1 @@
-const E="4.3.0";export{E as GENERATOR_VERSION};
+const E="5.0.0";export{E as GENERATOR_VERSION};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/generator",
-  "version": "4.3.0",
+  "version": "5.0.0",
   "description": "Pure infrastructure generation logic for Fjall",
   "type": "module",
   "main": "dist/src/index.js",
@@ -31,7 +31,7 @@
   },
   "scripts": {
     "clean": "rm -rf ./dist ./sourcemaps",
-    "build": "npm run clean && tsc && node ../scripts/minify-dist.mjs dist",
+    "build": "npm run clean && tsc && node ../scripts/minify-dist.mjs dist && node ../scripts/stamp-build.mjs",
     "prepack": "node ../scripts/check-dist-freshness.mjs",
     "watch": "npm run build && tsc --watch --preserveWatchOutput",
     "watch:only": "tsc --watch --preserveWatchOutput",
@@ -48,21 +48,21 @@
   },
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@fjall/util": "^4.3.0",
+    "@fjall/util": "^5.0.0",
     "ast-types": "^0.16.1",
-    "recast": "^0.23.11",
+    "recast": "^0.23.12",
     "ts-morph": "^28.0.0",
     "typescript": "^6.0.3",
     "zod": "^4.4.3"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^26.0.0",
-    "@vitest/coverage-v8": "^4.1.5",
-    "eslint": "^10.2.1",
-    "fast-check": "^4.7.0",
-    "typescript-eslint": "^8.59.1",
-    "vitest": "^4.1.5"
+    "@types/node": "^26.1.2",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^10.8.0",
+    "fast-check": "^4.9.0",
+    "typescript-eslint": "^8.65.0",
+    "vitest": "^4.1.10"
   },
-  "gitHead": "8a3ae096f9d15c47dc8c277c9bddfa40e4168c19"
+  "gitHead": "78dded6f582368076e8b5f351399219e5a954659"
 }