@fjall/util 34.0.0 → 35.0.0

package/dist/.minified

@@ -1 +1 @@
-124 files minified at 2026-09-05T22:58:50.480Z
+124 files minified at 2026-09-07T09:21:10.013Z

package/dist/aws/index.d.ts

@@ -6,6 +6,6 @@ export { FAILURE_ANALYSIS_CATEGORIES, type FailureAnalysisCategory } from "./fai
 export { maskFailureAnalysis } from "./maskFailureAnalysis.js";
 export { classifyDriftSuspectEvents, findCurrentOperationStart, isDriftSuspectReason, isOperationOpeningEvent, type DriftSuspectEvent } from "./driftSuspects.js";
 export { IPAM_OPERATIONS_POOL_TAG_KEY, formatIpamPairTagValue } from "./ipamTags.js";
-export { KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
+export { FJALL_RESOURCE_TYPE_TAG_KEY, FJALL_RESOURCE_TYPES, type FjallResourceType, KMS_RETENTION_TAG_KEY, S3_VERSIONING_EXEMPT_TAG_KEY, S3_VERSIONING_EXEMPTIONS, SDK_PRE_EMPTY_TAG_KEY, type S3VersioningExemption } from "./infraTags.js";
 export { COST_ALLOCATION_TAGS, DEFAULT_COST_ALLOCATION_ENVIRONMENT, DEFAULT_COST_ALLOCATION_OWNER, ecrCreateRepositoryTags, rdsPreMigrationSnapshotTags, type AwsSdkTag, type EcrCreateTag } from "./costAllocationTags.js";
 export { ACCOUNT_MONITORING_ROLE_NAME } from "./monitoringRole.js";

package/dist/aws/index.js

@@ -1 +1 @@
-import{AWSError as e,NoRolesFoundError as E,InvalidCredentialsError as _,SSOTokenExpiredError as t,MissingRegionError as T,ProfileNotFoundError as O,CommandError as s,isAWSError as i,isNoRolesFoundError as A,isSSOUnauthorizedError as S}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as p}from"./cloudformationTypes.js";import{countResourceProgress as R,formatElapsed as f}from"./deployProgress.js";import{CloudFormationFailureAnalyser as C}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as l}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as x}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as P,findCurrentOperationStart as M,isDriftSuspectReason as F,isOperationOpeningEvent as G}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as g,formatIpamPairTagValue as c}from"./ipamTags.js";import{KMS_RETENTION_TAG_KEY as U,S3_VERSIONING_EXEMPT_TAG_KEY as Y,S3_VERSIONING_EXEMPTIONS as v,SDK_PRE_EMPTY_TAG_KEY as y}from"./infraTags.js";import{COST_ALLOCATION_TAGS as W,DEFAULT_COST_ALLOCATION_ENVIRONMENT as h,DEFAULT_COST_ALLOCATION_OWNER as k,ecrCreateRepositoryTags as X,rdsPreMigrationSnapshotTags as z}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as b}from"./monitoringRole.js";export{b as ACCOUNT_MONITORING_ROLE_NAME,e as AWSError,n as CDK_NO_STACKS_MATCH,W as COST_ALLOCATION_TAGS,C as CloudFormationFailureAnalyser,s as CommandError,h as DEFAULT_COST_ALLOCATION_ENVIRONMENT,k as DEFAULT_COST_ALLOCATION_OWNER,l as FAILURE_ANALYSIS_CATEGORIES,g as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,U as KMS_RETENTION_TAG_KEY,T as MissingRegionError,E as NoRolesFoundError,O as ProfileNotFoundError,v as S3_VERSIONING_EXEMPTIONS,Y as S3_VERSIONING_EXEMPT_TAG_KEY,y as SDK_PRE_EMPTY_TAG_KEY,t as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,P as classifyDriftSuspectEvents,R as countResourceProgress,X as ecrCreateRepositoryTags,M as findCurrentOperationStart,f as formatElapsed,c as formatIpamPairTagValue,i as isAWSError,F as isDriftSuspectReason,A as isNoRolesFoundError,G as isOperationOpeningEvent,p as isResourceEvent,S as isSSOUnauthorizedError,x as maskFailureAnalysis,z as rdsPreMigrationSnapshotTags};
+import{AWSError as E,NoRolesFoundError as e,InvalidCredentialsError as _,SSOTokenExpiredError as T,MissingRegionError as t,ProfileNotFoundError as O,CommandError as A,isAWSError as s,isNoRolesFoundError as S,isSSOUnauthorizedError as i}from"./errors.js";import{STACK_NOT_FOUND_PATTERN as N,CDK_NO_STACKS_MATCH as n,isResourceEvent as R}from"./cloudformationTypes.js";import{countResourceProgress as C,formatElapsed as I}from"./deployProgress.js";import{CloudFormationFailureAnalyser as m}from"./CloudFormationFailureAnalyser.js";import{FAILURE_ANALYSIS_CATEGORIES as u}from"./failureAnalysisCategories.js";import{maskFailureAnalysis as l}from"./maskFailureAnalysis.js";import{classifyDriftSuspectEvents as x,findCurrentOperationStart as F,isDriftSuspectReason as M,isOperationOpeningEvent as G}from"./driftSuspects.js";import{IPAM_OPERATIONS_POOL_TAG_KEY as Y,formatIpamPairTagValue as g}from"./ipamTags.js";import{FJALL_RESOURCE_TYPE_TAG_KEY as c,FJALL_RESOURCE_TYPES as D,KMS_RETENTION_TAG_KEY as v,S3_VERSIONING_EXEMPT_TAG_KEY as y,S3_VERSIONING_EXEMPTIONS as V,SDK_PRE_EMPTY_TAG_KEY as W}from"./infraTags.js";import{COST_ALLOCATION_TAGS as k,DEFAULT_COST_ALLOCATION_ENVIRONMENT as J,DEFAULT_COST_ALLOCATION_OWNER as X,ecrCreateRepositoryTags as z,rdsPreMigrationSnapshotTags as H}from"./costAllocationTags.js";import{ACCOUNT_MONITORING_ROLE_NAME as j}from"./monitoringRole.js";export{j as ACCOUNT_MONITORING_ROLE_NAME,E as AWSError,n as CDK_NO_STACKS_MATCH,k as COST_ALLOCATION_TAGS,m as CloudFormationFailureAnalyser,A as CommandError,J as DEFAULT_COST_ALLOCATION_ENVIRONMENT,X as DEFAULT_COST_ALLOCATION_OWNER,u as FAILURE_ANALYSIS_CATEGORIES,D as FJALL_RESOURCE_TYPES,c as FJALL_RESOURCE_TYPE_TAG_KEY,Y as IPAM_OPERATIONS_POOL_TAG_KEY,_ as InvalidCredentialsError,v as KMS_RETENTION_TAG_KEY,t as MissingRegionError,e as NoRolesFoundError,O as ProfileNotFoundError,V as S3_VERSIONING_EXEMPTIONS,y as S3_VERSIONING_EXEMPT_TAG_KEY,W as SDK_PRE_EMPTY_TAG_KEY,T as SSOTokenExpiredError,N as STACK_NOT_FOUND_PATTERN,x as classifyDriftSuspectEvents,C as countResourceProgress,z as ecrCreateRepositoryTags,F as findCurrentOperationStart,I as formatElapsed,g as formatIpamPairTagValue,s as isAWSError,M as isDriftSuspectReason,S as isNoRolesFoundError,G as isOperationOpeningEvent,R as isResourceEvent,i as isSSOUnauthorizedError,l as maskFailureAnalysis,H as rdsPreMigrationSnapshotTags};

package/dist/aws/infraTags.d.ts

@@ -32,6 +32,46 @@ export declare const SDK_PRE_EMPTY_TAG_KEY = "fjall:sdk-pre-empty";
  * `__tests__/infraTags.test.ts` guards against casual renames.
  */
 export declare const KMS_RETENTION_TAG_KEY = "fjall:kms:retention";
+/**
+ * The Fjall resource-type marker tag key, shared by producers and consumers:
+ *
+ * - Producer (`@fjall/components-infrastructure`): `applyResourceTypeTag` /
+ *   `markDeployTimeWriter` (`lib/utils/resourceTypeTags.ts`) stamp it on the
+ *   VPC peering constructs and on every custom-resource writer subtree.
+ * - Producer (the Quick-Create connector template,
+ *   `public-assets/fjall/public-assets/assets/oidc-connector.yaml`): the three
+ *   writer role/function pairs carry the same key and value as the CDK twin.
+ * - Consumer (webapp posture): `isDeployTimeOnlyRole`
+ *   (`app/.server/services/compliance-rules/complianceUtils.ts`) matches the
+ *   marker before any role-name pattern, so a CloudFormation-named role is
+ *   excluded from `IAM_ROLE_UNUSED` by what it IS, not what it is called.
+ *
+ * The literal is deployed infrastructure state: renaming the key strips every
+ * already-tagged resource of its marker until the next deploy, and the posture
+ * exclusion silently falls back to the legacy name patterns. The pin test in
+ * `__tests__/infraTags.test.ts` guards against casual renames.
+ */
+export declare const FJALL_RESOURCE_TYPE_TAG_KEY = "fjall:resource:type";
+/**
+ * The closed vocabulary of `fjall:resource:type` values. One value per class
+ * of resource whose identity cannot be read off its physical name — never a
+ * second tag key, and never a per-construct value: `deployTimeWriter` is the
+ * single class for every role that CloudFormation assumes only while driving a
+ * custom resource (connector writers, IPAM, RDS, TLS, return-routes, identity
+ * store, aws-cdk-lib's own hoisted providers), the class the unused-role
+ * exclusion carves out — roles Fjall does not emit (CDK bootstrap, AWS
+ * Organizations) stay on that exclusion's name patterns.
+ *
+ * CDK resolves tag conflicts deeper-scope-wins, so a writer nested inside a
+ * `vpcPeering` subtree resolves to `deployTimeWriter` — the more specific
+ * truth about that role.
+ */
+export declare const FJALL_RESOURCE_TYPES: {
+    readonly vpcPeering: "vpc-peering";
+    readonly vpcPeeringAccepter: "vpc-peering-accepter";
+    readonly deployTimeWriter: "deploy-time-writer";
+};
+export type FjallResourceType = (typeof FJALL_RESOURCE_TYPES)[keyof typeof FJALL_RESOURCE_TYPES];
 /**
  * The S3 versioning-exemption marker tag, shared by producer and consumer:
  *

package/dist/aws/infraTags.js

@@ -1 +1 @@
-const t="fjall:sdk-pre-empty",e="fjall:kms:retention",o="fjall:s3:versioning-exempt",E=["build-output","isr-cache","cold-tier","access-logs"];export{e as KMS_RETENTION_TAG_KEY,E as S3_VERSIONING_EXEMPTIONS,o as S3_VERSIONING_EXEMPT_TAG_KEY,t as SDK_PRE_EMPTY_TAG_KEY};
+const e="fjall:sdk-pre-empty",t="fjall:kms:retention",r="fjall:resource:type",p={vpcPeering:"vpc-peering",vpcPeeringAccepter:"vpc-peering-accepter",deployTimeWriter:"deploy-time-writer"},c="fjall:s3:versioning-exempt",o=["build-output","isr-cache","cold-tier","access-logs"];export{p as FJALL_RESOURCE_TYPES,r as FJALL_RESOURCE_TYPE_TAG_KEY,t as KMS_RETENTION_TAG_KEY,o as S3_VERSIONING_EXEMPTIONS,c as S3_VERSIONING_EXEMPT_TAG_KEY,e as SDK_PRE_EMPTY_TAG_KEY};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/util",
-  "version": "34.0.0",
+  "version": "35.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",