@fntio/infra-client 0.0.0-stage → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,193 @@
+# Changelog
+
+What each release of `@fntio/infra-client` changed, newest first. Versions 0.1.0 to 0.1.11 were reconstructed from the commit history on 2026-09-10; from 0.1.12 on, every release adds its entry here before the version bump. Steps a release needs from you are on the wiki's Deploy and Upgrade page.
+
+## 0.5.0 — 2026-10-16
+
+**Upgrade:** hub stacks (`DataStack CredsStack WebStack`), then `NetworkStack` and every `Connector-<account>` stack if you run the private network — see the wiki's Deploy and Upgrade page, "Upgrading to 0.5.0".
+
+- Bell notices for a change that moves many targets at once are one row, not one per target: when one person gains or loses more than five roles, resources or plugin permissions through a group (a membership or bundle edit) or a cascade, the feed gets a single `kind: BUNDLE` notice carrying `count` and, for a group, `groupId`/`groupName` ("7,346 access grants · group · FullSystemAccess"). Adding a member to a 7,000-role group used to write 7,000 "access granted" rows for them, the pop-up logic re-raised that backlog as a fresh summary every minute, and `POST /notifications/revocations/seen` (one update at a time) could not clear it inside the request timeout. Mark-seen now runs 25 updates at a time; the web app folds raised notice keys older than its 500-key cap into a watermark instead of forgetting them. The activity log's per-person rows under such a change collapse the same way: one `access.gain`/`access.lose` row per person carrying `details.count` ("gained 7346 access grants via group FullSystemAccess") instead of one per target; the primary row's `affected` list is unchanged.
+- Renew sign-in before the 12-hour wall, from anywhere: the user menu's "Session ends" row becomes a "Renew sign-in" button that shows the time left (the end time is its tooltip); the desktop tray's session row gains "Renew sign-in…" (desktop app 0.5.0 or later). All of them start a fresh sign-in while the running session, its credentials and the VPN stay up until the new one lands — nothing is torn down mid-task.
+- Desktop: closing a backend tab no longer loses its address. The connect screen (the ＋ button) lists every deployment the app has connected to at least once under **Recently connected**, newest first with its project name; click one to reconnect, or its ✕ to forget it after a confirmation. Only that ✕ removes an entry (`recents.json` in the app's data folder, 20 entries). Reconnecting a saved deployment that was unreachable at startup now keeps its login session instead of starting a fresh one.
+- **Large catalogs (#39): the portal now holds a 4,000-account, 16,000-role catalog without the pages or the API growing with it.** The catalog (accounts, roles, group names) lives in an in-memory index per API container, rebuilt only when a catalog write moves a version row, and every catalog-sized list — my access, the admin Accounts page, the request picker, the users directory, a group's bundle — serves one paged contract (`?q=&filter[key]=a,b&sort=&limit=&cursor=` → `{items,nextCursor,total,facets}`; without `limit` each route answers its old whole-list shape, so existing clients keep working). Access is still decided in one place before any page is cut; the index lists, it never grants.
+- Dashboard (#45): a user who holds an account an admin kept off the dashboard gets a sticky search over everything they hold — results drop down as role rows with the card's actions (star, Console, Get credentials, the desktop auto-login bolt) — above **Signed in now** (roles with running credentials), **Main**, **Favorites** and **Recently vended**, each heading pinned while its cards scroll, and a table of the **Other accounts** (the roles outside Main and Favorites, five to start and more as you scroll; `GET /accounts` gains the `main` and `favorite` facets and a sparse `main: false` on each account for it); everyone else keeps the plain page unchanged.
+- Lists in panels and dialogs (a user's or group's roles, a service user's roles, a group editor's picked roles) show five rows, with Show more / Show less and a search box as soon as any are folded away, instead of thirty and "Show more"; the grant-roles dialog is wider and its dimension filter no longer opens off the dialog's edge. New account flag **Show in the Main section** (on by default; `main: false` on `POST/PATCH /admin/accounts`), `GET /accounts/home`, `PUT /preferences/favorites/{account}` (50 favorites, synced across devices), recents from credential and console vends. The admin Accounts page has a deployment-wide **Dashboard layout** choice (`PUT /admin/dashboard-layout`): automatic (the rule above), sections for everyone, or the plain list for everyone.
+- Account dimensions (#47), opt-in: `accountDimensions` in the project config stores tenant / project / stage on each account **when it is registered**, read off its name (`<tenant>-<project>-<stage>`; a pipeline may pass `dims` instead), admin-editable on the account form and never re-derived by a rename. They filter the dashboard search, the admin Accounts page, every account picker (request form, role form, grant dialogs) and the group editor, which gains **add one role across many accounts** (`POST /admin/groups/{id}/roles/bulk`, with a dry-run count). The role card's silhouette follows the stage through the config's stage map (`stages`); without the block nothing changes. A deployment turning it on backfills existing rows with `scripts/backfill-dimensions.mjs` (deployment README "Account dimensions"). The dashboard's search and browse results can be grouped by one dimension (a **Group by** choice beside the filter), and registering a role offers the groups that already bundle that role in the account's sibling accounts (same tenant and stage, `GET /admin/groups/suggest`).
+- Groups at scale (#43, #44): `POST /admin/groups/{id}/roles` and `DELETE …/roles/{account}/{role}` add or remove one role, written only if absent, so a pipeline registering accounts never races another writer (the full-list `PATCH` is read-modify-write); the add answers with the change (`{groupId, name, role, added}`), not the bundle, and neither call reads the whole bundle — a 4,000-role group answers in well under a second; the access diff behind a bundle edit reads only the touched targets; the group list caps each bundle at 50 roles with `roleCount` and `GET /admin/groups/{id}/roles` pages the rest; **one yearly review per group** (its clock = the latest approval or bundle change) replaces one per bundled role; the users directory caps each user's role and resource lists at 50 with totals, `GET /admin/users/{id}` carries everything.
+- Registration is idempotent (#43): `POST /admin/accounts` and `POST /admin/accounts/{a}/roles` answer `200` with the stored row when the same registration is sent again, `409` only when a field differs — a pipeline can retry any step. The admin forms still refuse a duplicate.
+- Target-account template (#43): `TargetAccountStack` / `targetAccountTemplate()` synthesize one account-agnostic CloudFormation template (native `AWS::IAM::OIDCProvider`, sub pin through `AWS::AccountId`) for StackSets or Control Tower, so a 4,000-account deployment does not need one CDK stack per account.
+- Pickers (#46): every place that listed the whole catalog in a `<select>` or a checkbox wall (request form, add-role form, group form, the grant dialogs on user, group and service-user panels) is a typeahead over one page at a time.
+- Access report (#46): `POST /admin/access-report/jobs` builds the CSV in the background (a second Lambda on the API bundle, 15-minute budget, private reports bucket with a 7-day expiry) and `GET …/jobs/{id}` hands back a 15-minute download link; the Users page's export uses it. The inline `GET /admin/access-report` remains.
+- Reads bounded by the catalog (#41, #44): `BatchGetItem` retries unprocessed keys and runs in parallel chunks; the admin bell reads the bare directory; the setup checklist counts from the index; the reconciler scans only what it needs.
+- Security Hub S3.9 and CloudFront.5: every hub bucket (web app, OIDC issuer, plugin assets) sends S3 server-access logs, and both CloudFront distributions send standard logs, into one new `AccessLogsBucket` in `DataStack` (90-day expiry, kept on teardown when `prod` is on). That bucket is the one that logs nowhere; AWS's own S3.9 text says to suppress its finding. Rides a deploy of all three stacks.
+- Private network: the ALB writes its access logs to a bucket of its own in `NetworkStack` (Security Hub ELB.5): SSE-S3, TLS-only, public access blocked, bucket-owner-enforced, objects expire after 90 days, its own access logs go to the hub's shared access-log bucket under `s3/alb-logs/`; the bucket is kept on a `prod` teardown and emptied and deleted otherwise. Rides a `NetworkStack` deploy.
+- Private network: ECS.20 passes on every network task definition. The control-server task is three non-root containers with no shared task volume: the init container renders the config and the self-signed TLS pair next to the database on the EFS mount (the access point performs every file operation as uid 0, whatever user the container runs as), the server container serves from there with its Unix socket on a per-container tmpfs and runs the two CLI bootstrap steps itself once the socket answers, so the `bootstrap-user` and `bootstrap-key` sidecars are gone and `Custom::HeadscaleApiKey` reads the key from the `headscale` container's own log stream (`headscale-<site>/headscale/<task>`); the publish-cert step reads the certificate from EFS. The connector task's two containers are non-root too, each with its own tmpfs, and the minted auth key crosses from the aws-cli container to the Tailscale container over the task's localhost instead of a shared file. The control server moves to the upstream `-debug` image tag (same Headscale, plus busybox for the start script). Why the layout changed: a Fargate task volume is root-owned 0755 when the task starts whatever mode the image gives the path, so 0.4.0's non-root containers could only share a volume a root init container had chowned, which kept ECS.20 failing on that container and on the connectors. Rides a `NetworkStack` deploy (each control server restarts once; the EFS directory gains `config.yaml`, `tls.key` and `tls.crt`) and a deploy of every connector stack (each connector re-registers once). Needs Fargate's tmpfs support (platform version `LATEST`, available in all Regions since January 2026) and aws-cdk-lib 2.263 or later.
+- Bell: temporary plugin permissions now warn before they end and once more after, like roles and network resources. New routes `GET /plugins/expiry` and `POST /plugins/expiry/seen`; the notice names the plugin and the account.
+- Removing an account now also denies its open plugin reviews and deletes a group that bundled nothing but that account's plugin permissions, as the role cascade already did.
+- `PUT /admin/plugins/{pluginId}/accounts/{accountNumber}/grants` answers 404 for a user that is neither in the pool nor a registered service user; `DELETE` still takes any id, so a deleted user's row stays revocable. Every plugin answer carries `Cache-Control: no-store`, 204s and errors included.
+- The activity log names the plugin on a revoke (it only did on a grant).
+- Plugin assets are uploaded with `Cache-Control: max-age=31536000, immutable` (their prefix carries the content hash), matching the app bundle.
+- Catalog provider: a construct rename no longer tombstones the record the new resource just wrote (the record remembers the logical id that owns it; CloudFormation's cleanup Delete for the old id is ignored). Provider tests now cover a retried Create, rollback after a failed install and after a failed update, and a reinstall over expired rows.
+- CDK tests pin that no method under a plugin path is unauthenticated, that the catalog record depends on the API stage, that no Function URL exists, and the feature's on → empty → off lifecycle.
+
+
+## 0.4.0 — 2026-10-08
+
+- Desktop: the app updates itself. A packaged app checks the Release feed a minute after launch and every six hours. On macOS the new version downloads in the background; the tray then offers "Update <version> · Restart to install" (the same teardown as Quit, then the new version relaunches), and a plain Quit installs it too. On Windows the installer is still unsigned, so the app only announces the version and the tray row opens the download page. Each Release now carries `latest-mac.yml`, `latest.yml` and `.blockmap` files next to the installers; an installed 0.3.0 needs one last manual DMG, since it predates the updater.
+- Private network: three of the four Security Hub findings an ECS or load-balancer control raised against the network stacks pass as shipped, and the fourth narrows. Every control-server and connector container runs on a read-only root filesystem (ECS.5); the Headscale server and its sidecars run as a non-root user (ECS.20), while the connector containers and Headscale's config-writing init container stay root, because a Fargate task volume is root-owned when the task starts whatever the image says, so the first writer of a shared volume must be root (the wiki's Security Posture lists ECS.20 for exactly those); and the load balancer reaches Headscale over HTTPS (ELB.21, ELB.22): the config-writing init container also mints a self-signed certificate at each task start, Headscale serves TLS on 8080 from it, and the target groups and their health checks speak HTTPS (the ALB never validates a target's certificate, so nothing has to be issued or rotated; the key minter and the reconciler reach the admin API over the same HTTPS inside the VPC and verify it against the certificate the task publishes to the SSM parameter `/<resourcePrefix>/headscale-tls-<site>` at every start, which only its own task role may write; the VPC gains an SSM interface endpoint for that read, since the functions have no internet path; removing a site now also means deleting that parameter, next to the API-key secret). Everything a container writes lives on one task volume at `/tmp`, which the init container hands to the non-root uid; the Headscale CLI finds its config from the working directory, so the ECS Exec commands in the runbook are unchanged. Rides a `NetworkStack` deploy (each control server restarts once) and a deploy of every connector stack (each connector re-registers once). The wiki's Security Posture page no longer lists ECS.5, ELB.21 or ELB.22 as accepted.
+- API: every `__`-prefixed row in the Resources table is bookkeeping, never a resource. The catalog listing, single-resource reads, the users directory and the network reconciler skipped only the reconciler's own `__reconciler-status__` rows; any other sentinel (a nameless `__catalog-version__` row written by a newer branch's API run against the same tables) reached the name sort and turned `/resources/expiry`, `/notifications/revocations` and `/admin/requests` into 502s.
+- Config: `loginMethods.smsOtp` is gone. It never worked (setting it failed at synth: SMS sign-in needs SNS, an origination number and SMS-sandbox exit, none of which the stacks provision). A config that sets it fails type-checking; remove the line. The remaining methods are unchanged.
+- Plugin pages: a plugin no longer reloads its data every minute. The portal re-reads plugin discovery on a timer (`plugins.discoveryRefreshSeconds`, default 60) and told the frame `accessChanged` on every answer, so a plugin following the SDK's guidance redrew each time; now the frame hears it only when its account list really changed.
+- Fixtures: the sample identities in the web bundle's story and fixture data, the API spec's examples and the desktop tests are invented names on fixture domains. The 0.3.0 release was built from the export before that change, so its bundle still carries a few of the previous placeholder names; no address, key or deployment value was ever included.
+- Config: `alertEmail` takes a list of addresses as well as one. Every address gets its own subscription to the ops alert topic (alarms and the issuer canary) and its own confirmation email on the next deploy; the first address is the default `email.dmarcReportEmail`. A single address keeps working unchanged.
+
+## 0.3.0 — 2026-10-07
+
+- **Private network: a resource in another account whose DNS name is also a service name in the hub account got the hub's address.** The reconciler asked the hub's Cloud Map for every resource's name first, so with the hub and a second account each running `litellm.<namespace>.internal` (or any shared label) in VPCs with the same range, the second account's rules pointed at the hub's task and its resource stayed unreachable. Now only a hub-account resource is resolved through the hub's Cloud Map and VPC DNS; every other account's resource goes to its own in-VPC `tailnet-resolver`, and the plain-DNS fallback from the hub is used for it only when the hub has no service by that label. Rides a `NetworkStack` deploy; the affected resources resolve correctly on the next pass.
+- Web app and desktop: the end of a sign-in is visible and warned (#29). The profile menu shows "Session ends 6:40 PM"; 15 minutes before it a banner above the page and a pop-up (new "Session ending" kind in the Notifications settings, on by default) say so; the desktop tray lists the time per backend and in its hover text. **Sign in again** from the banner or the pop-up is a handover, not a sign-out: the current session keeps running, credentials and the VPN stay, and the new sign-in takes over with a fresh 12 hours (the old refresh token is revoked). After a forced sign-out the sign-in page says why — the 12-hour limit, a session ended early, or a sign-out in another window — instead of a bare form. `config.json` carries `sessionHours` (the refresh-token validity, from one constant in `WebStack`), so the app never hardcodes 12.
+
+## 0.2.0 — 2026-10-06
+
+- Plugin pages: moving from one plugin page to another now starts that page's own frame. The frame of the previous plugin stayed on screen under a "newer version available" notice until a reload.
+- Plugin pages: the frame's colour scheme follows the portal's light/dark choice, so a plugin document themed dark is no longer given an opaque black backdrop; and `applyPluginUi` (`@fntio/infra-client-plugin-ui`) now sets the page base too: see-through background, no body margin, the portal's text colour and typeface, at zero specificity so a plugin's own rules win.
+- Private network: a resource's range may be as wide as `/16` (it was `/24`), for a subnet of hosts rather than one database. The reconciler's containment check against approved routes is unchanged, and the form states how many addresses a range wider than `/24` covers.
+- Private network: every call the reconciler makes to a site's control server has a time limit (10 seconds; 30 for the policy update), so a control server that accepts the connection and never answers fails its own site for that pass instead of spending the whole pass and leaving the other sites without a policy update; and a catalog row with no address is skipped instead of freezing its site's policy. Both ride a `NetworkStack` deploy.
+- **Private network: a DNS name that stops resolving no longer opens the resource's stored range.** The rules hold the addresses the name last resolved to for up to 24 hours after it last resolved, so a resolver blip does not cut access; after that, or for a name that has never resolved, nothing is open and the resource shows "DNS unresolved". Until now the whole registered range opened as the fallback. **Before deploying `NetworkStack`, check the admin Resources page for resources marked "DNS unresolved"**: they work through the range today and will stop until their name resolves (usually a connector stack deployed before the in-VPC resolver existed; redeploy it).
+- Private network: the reconciler approves a connector's advertised route only when it is private **and** inside the `routes` config declares for that connector's own VPC (`connectorVpcs`). Until now any private range was approved, so a connector in one account could advertise another account's subnet in the same site and receive its traffic. A refused route is logged and the rest are still approved (one bad route used to hold back all of them, silently); a route approved earlier that falls outside the declaration is logged, not removed. The rule is per site: once a site lists any connector VPC, every connector in that site must be listed, and one that matches no entry gets nothing approved; a site with no `connectorVpcs` at all keeps the private-range rule. Needs a `NetworkStack` deploy; **before it, check each connector advertises what `connectorVpcs.<account>.routes` says**, or a restarted connector's routes will wait unapproved.
+- Private network: a site's access rules are sent compact (about 40,000 user-resource pairs fit under the control server's 4 MB limit, up from about 24,000), the reconciler warns at three quarters of the limit and fails the pass with a clear error above it.
+- **Plugin pages: the plugin now owns the whole page.** The portal no longer draws a header (title, version, account picker) above the frame, and the frame fills the page area beside the sidebar; it was stuck at a 20rem minimum. A plugin draws its own title, and its own account picker if it needs one. **The portal no longer tracks a selected account at all** (plugin message protocol 2, plugin packages 0.2.0): it hands the frame the accounts the caller may use and their permissions, and which one the plugin works in is the plugin's own state. For plugin authors: `context.selectedAccount()`, `context.selectAccount()` and the `contextChanged` event are gone; `context.permissions()` is `context.permissionsFor(accountNumber)` and `context.hasPermission(p)` is `context.hasPermission(p, accountNumber)`; `accessChanged` is the one account event; `?account=` links are no longer read. **Every plugin must be rebuilt against the 0.2.0 plugin packages**; a page built on 0.1.x shows "built for a different version of the portal". The reference plugin shows the new shape. Switching between two entries of one plugin (`index.html#/user`, `#/admin`) and the "Try again" / "Reload it" buttons now really reload the frame.
+- Private network, opt-in: `network.mirrorImages` (hub) and the `mirrorImages` prop on `ConnectorStack` / `TailnetConnector` run the control servers and connectors from a copy of their image in the account's own registry, made at deploy, so a task restart no longer depends on GitHub's registry being reachable. Off by default; turning it on restarts each control server and connector once, and needs `npm install cdk-ecr-deployment` in the deployment project (an optional peer: nothing extra is installed otherwise).
+- Web app: a tab left open across more than one deploy could stop responding to a click on a page it had already recovered once; the click did nothing until a manual refresh. The one-reload-per-page guard from 0.1.18 was never cleared; it now clears on the next successful navigation.
+- Web app: the side panel (a resource's or user's details) now shrinks to the room the window leaves the page, down to its own minimum. A width dragged wide on a large screen carried over unshrunk, and on the admin Network page, whose table needs 860px, the panel went off the right edge.
+- Web app: being connected to a network where nothing is granted to you now says so. The network's bar chip and the sidebar pill turn amber with "nothing granted", and the empty state explains that every address is blocked and staying connected changes nothing. The connection itself is untouched; a new grant flips it back on the next sync.
+- Config: `branding.logoFile` takes a local image file (`.svg`, `.png`, `.jpg`, `.webp`, `.gif`, up to about 47 KB) and embeds it in the web app's config at synth, so a logo no longer needs a public URL. Not together with `logoUrl`.
+- Every Lambda function the package deploys carries a description saying what it is for.
+- `NetworkStack` no longer prints `CfnResource#addDependency is deprecated` on every synth and deploy.
+- Versioning from this release on: bug fixes raise the patch number, a new feature raises the minor, a breaking change raises the major.
+- Releases: the four plugin packages (`@fntio/infra-client-plugin-sdk`, `-cdk`, `-ui`, `-example`) are attached to every GitHub Release beside the core tarball, so a plugin author downloads them instead of cloning the repository and running `npm run pack:plugins`. The v0.1.18 Release carries them too (uploaded after the fact, built from the same source). The example README's install step and the Releasing wiki page describe the new path.
+- **Upgrade order: deploy 0.1.18 first.** DataStack no longer creates the access-model-v1 `Grants` and `ResourceGrants` tables (unread since 2026-08-17) or exports their names and ARNs. A deployment whose CredsStack or NetworkStack still imports those exports (every version before 0.1.18) fails this DataStack deploy with "export in use", so upgrade through 0.1.18 and deploy its `NetworkStack` by hand before this version. Deployments with `prod: true` keep both tables as orphans (RETAIN): delete them in the DynamoDB console afterwards, turning off deletion protection first; non-prod deployments lose them with the deploy. The one-off v1→v2 migration script is gone with them.
+
+## 0.1.18 — 2026-10-01
+
+- Access correctness: approving a yearly review now renews the standing grant in place and refuses (409) when that grant was revoked after the review was raised — it used to write a fresh grant, so a revoked role came back through the review queue; revoking a grant directly now closes the open review for it, a duration on a review approval is refused (it never applied), and a denial whose revoke fails no longer leaves a DENIED row beside live access. Vending a grant whose role is no longer in the catalog is DENIED with reason `NO_ROLE` instead of assuming a conventional ARN.
+- Admin API hardening: every `:userId` must be a Cognito sub or service-user client id (an email used to slip past the last-admin and self-delete guards); `admin` must be a boolean; account and role free-text fields must be strings with length caps (a stored number in an account name broke every accounts list); the user profile-name override follows the same charset rule as admin-set names.
+- Catalog deletes: role, account and resource deletes revoke grants, drop group bundles and deny the target's open requests and reviews BEFORE the catalog row goes, and can be repeated after a failure (an already-removed role still sweeps its leftovers before the 404); a cascade no longer leaves an empty group. `DELETE /admin/accounts/{id}` answers 409 while the account still has network resources.
+- Offboarding: deleting or demoting a user ends their sessions at once (`AdminUserGlobalSignOut`), and admin routes re-check the admins group once a minute per API container, so an already-issued token cannot keep admin access for the rest of its hour. The API role gains `cognito-idp:AdminGetUser` and `cognito-idp:AdminUserGlobalSignOut` (rides the hub deploy).
+- Deploys: the site's hashed assets upload with a one-year immutable cache and `index.html`/`config.json` with `no-cache` (browsers no longer keep the previous shell for a day after a deploy); the web app reloads when a page's chunk from a pruned build fails to load; the deploy workflow verifies the live bundle matches the build. The cdk-nag gate runs in CI (it had been skipping itself when the frontend was not built).
+- Security headers: app pages send an enforced Content-Security-Policy (self, the region's Cognito API and the hosted-UI domain; it ran report-only on the development deployment first with no violation across the e2e suite); plugin assets get their own enforced policy that allows the portal only. The shell's boot-failure script is allowed by a hash WebStack computes from the index.html it deploys, and the frontend build no longer inlines critical CSS (its stylesheet link carried an inline `onload`). A plugin that loads anything from a third-party host has never worked under the plugin policy and does not work under the app policy either. The scripts Cognito client (`/.well-known/infra-client`) no longer reveals whether an email address has an account.
+- Web app: the admin role, resource and group panels reload their lists when the panel is pointed at another row (they showed the previous row's holders); the Get-credentials dialog is re-created when a toast or deep link switches its role; a sign-out that raced the hourly token renewal no longer signs the user back in; a plugin page keeps its session across a transient renewal failure; the sign-up link works seconds after creating a user (consistent lookup); a refused last-admin delete no longer ends that admin's dev shares first.
+- Desktop (needs the next desktop build): the credentials writer never replaces or deletes a profile it did not write (a role renamed to `default` used to overwrite the user's long-lived keys), a settings file that is not a list no longer blocks startup, the device key can no longer appear in a CLI error detail, Electron 44 with fuses set. `cd desktop && npm test` runs the new unit tests.
+- API runtime: the handler runs at 1024 MB; the console federation call and the STS/KMS clients have a 4 s deadline so a hang cannot skip the vend's audit row; the vend reads access strongly consistent; the legacy Grants/ResourceGrants tables (access model v1, unread since 2026-08-17) are no longer referenced by CredsStack or NetworkStack at all (no env, no IAM, no output). DataStack still deploys them and keeps exporting their names and ARNs, because CloudFormation refuses to drop an export while a deployed stack imports it and DataStack deploys first. **The next release removes the tables, so deploy this version before upgrading past it** (a manual `NetworkStack` deploy counts). Deployments with `prod: true` keep the tables as orphans (RETAIN); delete them by hand afterwards (turn off deletion protection first).
+- Desktop tray: the credential expiry alarms no longer fire all at once when the Mac wakes from sleep. An alarm that comes due while the machine is asleep waits 30 seconds after the wake, so the app can renew the credentials or, past the 12-hour sign-in limit, log out and purge them first; only credentials still on file and still expired are then reported, and "expires in 1 minute" is never said of something already expired. Needs the next desktop build.
+
+## 0.1.17 — 2026-09-29
+
+- Desktop keep-fresh: a starred role's credential renewal now survives the machine sleeping — on wake, reconnect or window focus the app re-vends whatever is due and re-arms the other timers from the wall clock — and a renewal that fails (offline, a 5xx, a timeout) is retried on a doubling delay from 30 s to 5 min instead of stopping silently, with one toast after the second failure. A revoked grant or a dead session still ends that role's loop. Before this, one missed renewal after a laptop sleep left the profile expired until "Renew all now".
+- Activity log: the Activity page now records every action that changes or uses access, not only vends — grants and revokes of roles, network resources, plugin permissions and dev shares (direct, bulk or through a group), group membership and bundle edits, requests raised, approved and denied, yearly reviews raised and lapsed, expiries, catalog changes to accounts, roles, resources and groups, user invites, deletions, admin changes, MFA resets and the service-user lifecycle, refused admin and plugin calls, and — from the reconciler's five-minute pass — VPN sessions per site, firewall rules written and connectors pruned. Each row names who did it (people, service users, or `system:<job>`), what, to whom or what, the outcome and why; group, cascade and bulk changes also write per-user "gained / lost" rows, hidden by default. The page filters by a custom date-time range as well as the 7/30/90-day presets, by type, outcome, account, actor, person and the specific role, resource, group, site, plugin, share or service user, loads older rows past a full page, and every user, role, resource and group panel links to its history. The Users page gains an **Access report** CSV of who can reach what right now. `GET /admin/audit` takes the new filters (`from`, `to`, `before`, `user`, `actor`, `category`, `outcome`, `account`, `group`, `target`, `derived`) and returns `ActivityPage`; `GET /admin/access-report` is new. Config: `audit.retentionDays` (default 400). Older vend rows are read in the new shape; nothing is migrated. Deploy notes in the package README's upgrade section (one new table index, a `NetworkStack` redeploy for the VPN rows).
+- Activity log follow-ups: an account, role, resource or branding save that changes nothing no longer writes an update row; a revoke row whose access continues through a group names the group ("still held through group Platform") instead of a generic note; expired grants are logged by the expiry sweep (`system:expiry`) rather than under the yearly review; branding edits file under Catalog instead of Users & admins.
+- Pop-up notifications: the bell's items can raise system notifications when the app is behind another window — in the desktop app always, in a browser once allowed from the new **Notifications** entry in the user menu, which also has a switch per kind. Two bell gaps close with it: access granted without a request (a direct grant, a group that now bundles it, a port shared with you) is now a bell item, and expiring or expired access pops up at the same threshold the bell already used. `GET/PUT /preferences/notifications` store the choices server-side; notices from `GET /notifications/revocations` carry `change: GRANTED | REVOKED`. Desktop: the shell now declares its Windows AppUserModelID (toasts never showed on Windows without it), clicking a notification opens the right page, resolved items close their toast, the bell polls immediately after wake from sleep, and an unexpected VPN drop raises a local notification. Needs the next desktop build for the desktop-side changes; the web app works with older shells.
+- Setup band (pull request #28): the setup checklist is pinned above every page as a band until the required steps are done, with the progress shown in the user menu, and it refreshes only when the page changes; the collapsed sidebar rail is tidied; the theme wizard's Reset buttons restore the deployment's configured branding rather than built-in defaults, and its border-strength seed is painted on open so Save persists what the admin saw; the Users bulk-action bar now appears only once a row is selected. The Bold and Solid icon styles no longer draw half strokes for several icons, and the Bold Operate icon keeps its crossed tools.
+- Accounts order: **Arrange order** on the admin Accounts tab lets an admin drag accounts, and the roles inside each, into the order every page then shows to every user (the arrows on each row do the same from the keyboard); accounts and roles without a position list after the ordered ones, by name (accounts sorted by number before). New route `PUT /admin/accounts/order` taking `accounts: [{ accountNumber, roles? }]`; each save records an `account.reorder` activity row.
+- User panels: a **History** tab lists the person's activity in place (last 90 days, older on demand), with **Open in Activity** for the full filters; the link that left the page is gone.
+- Sign-up link: Create user now opens the new user's panel straight away (grants live there), and the invitation email can be switched off on the form (`sendEmail: false`; the user still gets a temporary password). Only then does the API answer with the `/login#inv=` link the email would otherwise carry, and the panel shows it with the app's address to copy; while the email goes out, no link leaves the server. A pending user's panel gains **Copy sign-up link**, which mints a fresh temporary password and so retires the emailed one; **Send invite email** (formerly Resend invite, which read wrong after a link-only invite) retires a copied link in turn. New route `POST /admin/users/{userId}/signup-link`; `POST /admin/users` and `/admin/users/bulk` take `sendEmail` and return `signupLink` only when it is `false`. Nothing is stored. Needs the CredsStack deploy this version brings (the API learns its own address and may set temporary passwords).
+- Desktop: the tab label, the tray's groups and the saved registry entry follow a project rename in the theme wizard right away, and a VPN tunnel left up by a previous run (a crash, a reboot, a quit that lost the logout race) is dropped at start when auto-reconnect is off instead of being shown as Connected. Both need the next desktop build.
+
+## 0.1.16 — 2026-09-21
+
+- Theme wizard (issue #27): the preview picker offers the real Network, Users and Groups pages with sample data, and a "Preview as" toggle shows an admin's screens or a member's; each page loads the first time it is shown and follows every knob live.
+- Several connector VPCs per account (issue #17): `connectorVpcs.<account>` takes a list, every entry but one carrying a `name` that suffixes the connector's hostname (`connector-<account>-<name>`), its stack id (`Connector-<account>-<name>`) and its SG-manager and resolver function names. The reconciler asks every VPC's manager and resolver of an account; a manager now answers `other-vpc` for a security group outside its VPC instead of failing on it (the Network page shows "SG outside connector VPCs"), and the admin Network map draws one connector per declared VPC. A single VPC per account is unchanged. `GET /admin/network` returns `connectorVpcs.<account>` as a list. Deploy the hub's NetworkStack first; when an account gains a second VPC, redeploy its existing ConnectorStack too (see the package README's upgrade note).
+
+## 0.1.15 — 2026-09-21
+
+- The Release now carries a Windows installer, `infra-client-<version>-x64.exe`, next to the macOS one. It is unsigned for now: the first launch shows SmartScreen's "Windows protected your PC" screen, and **More info**, then **Run anyway** gets past it once per downloaded file. Nothing in the package changed.
+- Plugin SDK: the sample session in `@fntio/infra-client-plugin-sdk/fixtures` expires an hour after it is loaded instead of at a fixed instant, which passed on 2026-09-21 and made every suite built on it ask the host for an "expiring" refresh.
+
+## 0.1.14 — 2026-09-17
+
+- Customer plugins (`plugins.enabled`, off by default): a deployment can bolt independently built plugins onto the portal — a frontend shown in an iframe on the portal's own origin, and Lambda routes behind a shared API Gateway authorizer. Two permission levels per plugin, `user` and `admin`, granted per account from the same Users and Groups screens as roles, with `admin` including `user` only where the plugin declares it. Plugin entries join the sidebar after the core items of their section, and a plugin-admin entry opens Administration for someone holding no core admin rights. New routes `GET /plugins`, `GET /admin/plugins`, `GET/PUT/DELETE /admin/plugins/{pluginId}/accounts/{accountNumber}/grants`, `GET /admin/users/{userId}/plugin-grants`, `GET /admin/groups/{groupId}/plugin-grants`; revocation notices gain kind `PLUGIN`. Grants live in the existing access table and join the yearly review lifecycle. Registering a plugin needs its frontend built before synth. See the Plugins section of the package README.
+- Three new packages ship alongside: `@fntio/infra-client-plugin-sdk` (contracts, the iframe SDK and the host adapter), `@fntio/infra-client-plugin-cdk` (`definePlugin`), and `@fntio/infra-client-plugin-ui` (theme helpers and an Angular HTTP interceptor). Two agent skills ship inside them, for building a plugin and for integrating one into a CDK application that already exists.
+- With `loginMethods.federation` configured, the invite email tells the person to use the provider's sign-in button and that no password is needed; the set-password link stays underneath for local users.
+- Invites past Cognito's built-in daily email cap (about 50 a day per AWS account without the `email` block) now fail with a message that says so and points at the `email` block or the SES quota, instead of Cognito's wording; the user is not created either way.
+- Releases are GitHub Releases from this version on: the tag `v<version>` carries the package tarball and the signed macOS desktop installer, and the desktop app now shares the package's version number (it was 0.1.3).
+
+## 0.1.13 — 2026-09-15
+
+- Accounts page: the Console button shows a spinner and refuses a second click while the sign-in link is being created; each extra click vended another set of credentials and opened another tab (issue #13).
+- Connector VPCs outside the hub's region (issue #15): `connectorVpcs.<account>.region` deploys `ConnectorStack` there and keeps grant-driven security-group rules and DNS re-resolution working for that account. The hub gains a relay function outside its VPC (a foreign-region function is unreachable from inside it) on its own invoke-only role, which such a connector's SG-manager and resolver trust; the connector's key-mint step now runs in the hub's region. Needs a manual `NetworkStack` deploy (it adds the relay role on every hub); the next `ConnectorStack` deploy rolls the connector task once. Bootstrap a foreign region before deploying into it. Without the field nothing else changes.
+
+## 0.1.12 — 2026-09-15
+
+- Federated sign-in (`loginMethods.federation`, off by default): one OIDC provider per entry (Entra ID first), offered on the login page next to the local methods on a dedicated app client that alone may write the mapped claims. Nobody signs in without an invite — a first federated sign-in is linked to the invited user with that email, an unknown email is refused — and the mapped claims ride the ID token into the admin directory and audit rows. The provider's asserted email is the trust assumption; see the Security Posture and Runbooks (Users) wiki pages.
+- Session end: at the 12 h wall the desktop app could stay signed out on the page it was on, showing the API's `Missing bearer token`; it now lands on the sign-in page (before the desktop purges credentials and drops the VPN), a 401 that outlives the session reads "Your session has ended", and the sign-in page no longer polls the API.
+- Desktop 0.1.3: the bridge refuses calls from any page that is not the backend's own (the SSO hop keeps identity-provider pages in-view); `npm run dist` starts electron-builder on Windows.
+- Network page: the Share a local port button's icon is readable at its size.
+- Dev shares (`network.devShares`, off by default): a user shares one local port on their laptop with named users or groups on the same site for a bounded time; the desktop app runs `tailscale serve`, the reconciler writes a per-grantee rule to the owner's device, and the API kicks a reconciler pass on create/stop. New routes `GET/POST /network/shares`, `GET /network/shares/directory`, `DELETE /network/shares/{shareId}`, `GET /admin/network/shares`; revocation notices gain kind `SHARE` and via `OWNER`; the access table gets a `ttl` attribute (share rows only) and group rows now honor an `expiresAt`. Needs a manual `NetworkStack` deploy (reconciler rules + reserved concurrency). See the Private Network wiki page.
+
+## 0.1.11 — 2026-09-09
+
+- Per-token API rate limit: the new `waf.perTokenRateLimit` (default 2000 requests per bearer token per 5 minutes) on the API web ACL caps a runaway or leaked token. See the Configuration Reference wiki page.
+- The OpenAPI spec's version now follows the package version.
+
+## 0.1.10 — 2026-09-09
+
+- The portal API has an OpenAPI 3.1 contract, shipped as `openapi.yaml` in the package root. Its route inventory is drift-tested against the mounted routes, and a Postman collection is generated from the spec.
+- Desktop 0.1.2: `infraclient://` deep links, and the login page offers "Open in the desktop app".
+
+## 0.1.9 — 2026-09-09
+
+- Login: "no passkey in this browser or app" is now told apart from a dismissed passkey prompt.
+- Desktop 0.1.1: on macOS, the app launched from the Dock never actually logged the VPN client in while reporting success; the Tailscale CLI is now invoked correctly.
+- Desktop build fixes: signed artifacts were labelled as unsigned, and the macOS build runner is pinned.
+
+## 0.1.8 — 2026-09-08
+
+- The credential issuer is served as static files from a private S3 bucket behind CloudFront on the same hostname, instead of an API Gateway HTTP API. Signing keys and every workload account's trust are unchanged. The hub account needs `us-east-1` bootstrapped; see the 0.1.8 notes in the Deploy and Upgrade wiki page.
+- Root and package READMEs rewritten for consumers; stale asset paths fixed.
+
+## 0.1.7 — 2026-09-08
+
+- Security Hub AWS Foundational Security Best Practices pass: `prod: true` now drives further hardening (load balancer, VPC, EFS), the API stage logs its access, and the MFA requirement for password-only pools is an explicit config choice (`loginMethods.mfa`). See the Security Posture wiki page.
+
+## 0.1.6 — 2026-09-08
+
+- The deploy-side Security Hub suppression added in 0.1.5 is reverted: automation rules are administrator-only, so accepted findings are suppressed by hand instead.
+
+## 0.1.5 — 2026-09-08
+
+- WAF web ACLs on CloudFront and the API stage, on by default with a per-IP rate limit (`waf` block).
+- Three by-design Security Hub findings suppressed from the deploy (reverted in 0.1.6).
+- Credential countdowns show hours (11:58:03, not 718:03).
+- Failed credential vends reach the Activity page as a FAILED outcome; the Activity page gains an outcome filter; tables get sticky headers.
+- VPN: per-site in-VPC resolvers heal cross-account DNS drift.
+- Runbooks for signing-key rotation and restore from backup; upgrade skew notes (deploy hub stacks together, refresh stale bundles).
+- Desktop 0.1.0: macOS code signing and notarization with a manual build workflow, Touch ID passkeys in signed builds, and the provisioning profile embedded so the passkey entitlement no longer kills the app at launch. A self-update mechanism was added and backed out in the same window.
+
+## 0.1.4 — 2026-08-31
+
+- `githubRepo` removed from `ProjectConfig`. Only the internal deploy pipeline read it, so consumers without a GitHub pipeline no longer need a dummy value.
+
+## 0.1.3 — 2026-08-31
+
+- `CredsStack` ships the API Gateway account CloudWatch role. Consumer deployments synthesizing with the `@aws-cdk/aws-apigateway:disableCloudWatchRole` feature flag failed with "CloudWatch Logs role ARN must be set in account settings"; this fixes it.
+- VPN: the deploy mints each site's control-plane admin user and API key itself, and prunes offline connector predecessors behind a live replacement. The only manual step left is deleting a removed site's secret.
+- VPN opt-in: without a site, the Network pages are hidden and resource registration is refused.
+- Production hardening: identity resources retained on teardown, earlier failures at synth, and `issuer.keyVersions` / `signerVersion` default to `[1]` / `1`.
+- Setup checklist reports the configured email sender; invite lists can be uploaded; an icon-style setting with three bundled icon sets; toolbars and column headers stay pinned on the Users, Service users and Groups tables.
+
+## 0.1.2 — 2026-08-26
+
+- 0.1.1 had already been minted for a consumer deployment from its own deployment repository, so the setup-checklist build ships as 0.1.2.
+- Setup checklist edge hardening; an accidentally committed pack tarball removed from the repository.
+
+## 0.1.1 — 2026-08-26
+
+- First-admin setup checklist: a card at the top of the home page for admins whose items check themselves off from live state, reopenable from the sidebar user menu (`GET /admin/setup`).
+- First admin from config: the `firstAdmin` block creates the admins-group account during the deploy and reports `FirstAdminInviteSent`.
+- Setup hardening: more synth-time validation, and placeholders shaped like real addresses are refused.
+- Session length end to end (the 12-hour role cap), theme and login fixes.
+- Desktop: quitting logs out site tunnels a crashed run left behind.
+- Truthful MFA messaging and a flow-neutral verification email.
+
+## 0.1.0 — 2026-08-25
+
+First packaged build. The repository became npm workspaces with `@fntio/infra-client` as the package and the internal deployment as a separate app, and `npm pack` yields a working beta tarball: compiled `dist/`, prebundled Lambdas, the built web app, runtime dependencies as `vendor_modules`. The same day brought the consumer-grade construct API (the hub locator, `TargetAccountStack`, `ConnectorStack`, the principal factory, and the `samples/` apps) and consumer-facing docs. Product features that landed before this point predate versioning and are not listed here.

package/LICENSE

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.