@fjall/components-infrastructure 0.95.0 → 0.96.0

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -1,405 +1,15 @@
-import { type RepositoryImage, type ICluster, type IBaseService } from "aws-cdk-lib/aws-ecs";
-import { type Repository } from "aws-cdk-lib/aws-ecr";
-import { type Connections, type IVpc, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
-import { type PolicyDocument, type IManagedPolicy, type IGrantable, Grant } from "aws-cdk-lib/aws-iam";
+import { type ICluster, type IBaseService } from "aws-cdk-lib/aws-ecs";
+import { type Connections, type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
+import { type IGrantable, Grant } from "aws-cdk-lib/aws-iam";
 import { type IApplicationLoadBalancer, type ApplicationListener } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Construct } from "constructs";
-import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type IEcsCompute } from "./interfaces/compute.js";
-import { type ConnectionSpec } from "./interfaces/connector.js";
-import EcsCluster, { type EcsClusterProps, ScalingType, type DomainConfig, type EcsCapacityProvider, type Ec2CapacityConfig } from "../../resources/aws/compute/ecs.js";
-import type { EcsServiceAlarmThresholds } from "../../resources/aws/monitoring/index.js";
-import { type SecretImport } from "../../resources/aws/secrets/index.js";
-export { ScalingType };
-export type { EcsCapacityProvider, Ec2CapacityConfig };
-/**
- * Configuration for ECS capacity providers.
- */
-export interface EcsCapacityProviderConfig {
-    /** Whether this uses Spot pricing */
-    usesSpot: boolean;
-    /** Whether this runs on EC2 instances (vs serverless Fargate) */
-    usesEc2Instances: boolean;
-}
+import EcsCluster, { type EcsClusterProps } from "../../resources/aws/compute/ecs.js";
+export { ScalingType } from "./computeEcsTypes.js";
+export type { EcsCapacityProvider, Ec2CapacityConfig, RemoteConnectionSpec, EcsCapacityProviderConfig, EcsContainerConfig, EcsScalingConfig, EcsClusterConfig, EcsRoutingConfig, EcsServiceConfig, EcsComputeProps } from "./computeEcsTypes.js";
+import { ScalingType, type EcsCapacityProviderConfig, type EcsCapacityProvider, type EcsScalingConfig, type EcsServiceConfig, type EcsComputeProps } from "./computeEcsTypes.js";
 export declare const ECS_CAPACITY_PROVIDER_CONFIG: Record<EcsCapacityProvider, EcsCapacityProviderConfig>;
 export declare function getEcsCapacityProviderConfig(provider: EcsCapacityProvider): EcsCapacityProviderConfig;
-/**
- * Configuration for a container in an ECS task.
- *
- * For single-container services, `name` is optional and defaults to `${serviceName}Container`.
- * For multi-container tasks, the first container with a `port` is the **primary container**
- * that receives load balancer traffic.
- *
- * @example
- * // Single container (name auto-generated)
- * containers: [{ port: 3000 }]
- *
- * @example
- * // Multi-container with sidecars
- * containers: [
- *   { name: "app", port: 3000 },                    // Primary - receives ALB traffic
- *   { name: "datadog", image: "datadog/agent" }     // Sidecar - monitoring
- * ]
- */
-export interface EcsContainerConfig {
-    /** Container name. Optional for single-container services. */
-    name?: string;
-    /**
-     * Container image. Options:
-     * - Omit: Uses app's default ECR repository (primary container only)
-     * - string: ECR repository name or public image URL
-     * - Repository: CDK ECR Repository construct
-     */
-    image?: string | Repository;
-    /**
-     * Port the container listens on.
-     * The first container with a port becomes the **primary container**
-     * and is registered with the load balancer.
-     */
-    port?: number;
-    /** Environment variables */
-    environment?: Record<string, string>;
-    /**
-     * Secrets from AWS SSM Parameter Store.
-     * Array of secret names that will be fetched from the service's SSM namespace.
-     * The namespace path is auto-determined from app/cluster/service names.
-     *
-     * @example
-     * // Secrets at /myapp/api-cluster/users/API_KEY and /myapp/api-cluster/users/DB_PASSWORD
-     * secrets: ["API_KEY", "DB_PASSWORD"]
-     */
-    secrets?: string[];
-    /** Secrets imported from other CDK resources (AWS Secrets Manager) */
-    secretsImport?: Record<string, SecretImport>;
-    /** Command to run in the container */
-    command?: string[];
-    /** Entry point for the container */
-    entryPoint?: string[];
-    /**
-     * Whether this container is essential.
-     * If an essential container stops, all containers in the task stop.
-     * Default: true
-     */
-    essential?: boolean;
-    /**
-     * Health check configuration.
-     * Default: For primary container with port, uses curl health check.
-     */
-    healthCheck?: {
-        command: string[];
-        interval?: number;
-        timeout?: number;
-        retries?: number;
-        startPeriod?: number;
-    };
-}
-/**
- * ECS scaling configuration.
- * - Omit: enabled with defaults
- * - `{}`: enabled with defaults
- * - `{ minCapacity: 2, maxCapacity: 10 }`: custom scaling
- * - `false`: explicitly disabled
- */
-export interface EcsScalingConfig {
-    minCapacity?: number;
-    maxCapacity?: number;
-    scalingType?: ScalingType;
-}
-/**
- * Cluster-level configuration.
- * Controls the shared ALB for all services in this cluster.
- */
-export interface EcsClusterConfig {
-    /**
-     * Domain for HTTPS access.
-     * - Omit: ALB created with default DNS (*.elb.amazonaws.com)
-     * - Specified: Creates ACM certificate + Route53 DNS A record
-     */
-    domain?: string;
-    /**
-     * Load balancer configuration.
-     * - Omit or "public": Internet-facing ALB (default)
-     * - "internal": VPC-only ALB
-     * - false: No ALB (for workers/background processors)
-     */
-    loadBalancer?: false | "public" | "internal";
-    /**
-     * Enable direct EC2 access without ALB.
-     * Uses host network mode for predictable ports.
-     * Access via EC2 public IP at container port.
-     */
-    directAccess?: boolean;
-    /**
-     * Advanced domain configuration for routing policies (latency, weighted, geo).
-     * Only used when domain is specified.
-     * Allows for multi-region deployments with advanced DNS routing.
-     */
-    domainConfig?: DomainConfig;
-}
-/**
- * Routing configuration for path/host-based routing on the ALB.
- * Required when cluster has multiple services with ports.
- * Optional for single service (gets all traffic automatically).
- */
-export interface EcsRoutingConfig {
-    /**
-     * Path pattern for routing (e.g., "/api/*", "/users/*").
-     * Uses ALB path-based routing.
-     */
-    path?: string;
-    /**
-     * Host header for routing (e.g., "api.example.com").
-     * Uses ALB host-based routing.
-     */
-    host?: string;
-    /**
-     * Priority for this routing rule (1-50000).
-     * Lower number = higher priority.
-     * Auto-assigned if omitted.
-     */
-    priority?: number;
-    /**
-     * Health check path for this service's target group.
-     * Default: "/"
-     */
-    healthCheckPath?: string;
-}
-/**
- * Configuration for a service in an ECS cluster.
- * Each service gets its own task definition, scaling config, and target group.
- *
- * @example
- * // Simple service
- * { name: "api", containers: [{ port: 3000 }] }
- *
- * @example
- * // Service with routing (for multi-service clusters)
- * { name: "users", containers: [{ port: 3000 }], routing: { path: "/users/*", priority: 100 } }
- *
- * @example
- * // Service with multiple routing rules (same target group)
- * { name: "web", containers: [{ port: 3000 }], routing: [
- *   { path: "/api/v2/*", priority: 50 },
- *   { path: "/*", priority: 200 },
- * ]}
- *
- * @example
- * // Service with sidecars
- * {
- *   name: "api",
- *   containers: [
- *     { name: "app", port: 3000 },
- *     { name: "datadog", image: "datadog/agent" }
- *   ]
- * }
- */
-export interface EcsServiceConfig {
-    /** Service name (unique within cluster) */
-    name: string;
-    /**
-     * Container image for this service (applies to first container without explicit image).
-     * - Omit: Uses app's default ECR repository
-     * - string: ECR repository name or public image URL
-     * - Repository: CDK ECR Repository construct
-     */
-    image?: string | Repository;
-    /**
-     * Container configuration(s) for this service.
-     * For single-container services, container name is optional and auto-generated.
-     * For multi-container services, the first container with a port is the primary container.
-     */
-    containers?: EcsContainerConfig[];
-    /**
-     * Routing rules for this service on the cluster's ALB.
-     * Required when cluster has multiple services with ports.
-     * Optional for single service (gets /* automatically).
-     * Can be a single rule or an array of rules pointing to the same target group.
-     *
-     * @example
-     * // Multiple routes for the same service
-     * routing: [
-     *   { path: "/api/v2/*", priority: 50 },
-     *   { path: "/*", priority: 200 },
-     * ]
-     */
-    routing?: EcsRoutingConfig | EcsRoutingConfig[];
-    /** CPU units for this service's tasks (256-4096) */
-    cpu?: number;
-    /** Memory in MiB for this service's tasks (512-30720) */
-    memoryLimitMiB?: number;
-    /** Desired number of tasks. Default: 2 */
-    desiredCount?: number;
-    /**
-     * Scaling configuration.
-     * - Omit: enabled with defaults
-     * - false: disabled
-     */
-    scaling?: EcsScalingConfig | false;
-    /**
-     * Path to Dockerfile for building this service's image.
-     * Metadata for CLI build process, not used during CDK synthesis.
-     */
-    dockerfilePath?: string;
-    /**
-     * Docker build target stage for multi-stage Dockerfiles.
-     * When specified, the CLI builds with `--target <dockerTarget>`.
-     * The image tag suffix is also updated: `<service>-<target>-latest`.
-     *
-     * @example
-     * // Dockerfile: FROM node AS base ... FROM base AS api ... FROM base AS worker
-     * { name: "api", dockerTarget: "api" }   // builds: myapp-api-api-latest
-     * { name: "worker", dockerTarget: "worker" }  // builds: myapp-worker-worker-latest
-     */
-    dockerTarget?: string;
-    /**
-     * Additional inline policies for this service's task role.
-     * Added on top of the default ECS Exec permissions.
-     * Use for service-specific AWS permissions (S3, DynamoDB, SQS, etc.).
-     */
-    taskRoleInlinePolicies?: Record<string, PolicyDocument>;
-    /**
-     * Additional managed policies for this service's task role.
-     * Added on top of the default ECS Exec permissions.
-     */
-    taskRoleManagedPolicies?: IManagedPolicy[];
-    /**
-     * Resources this service needs to connect to (e.g., databases, S3 buckets, SQS queues).
-     * Creates security group rules for IConnectable resources and IAM grants for IAM resources.
-     * Follows least-privilege - only this service gets access, not all services in the cluster.
-     *
-     * Supports:
-     * - IConnectable: Security group resources (RDS, ECS, etc.)
-     * - IStorageConnector: S3 buckets (IAM grants)
-     * - IDynamoDBConnector: DynamoDB tables (IAM grants)
-     * - IQueueConnector: SQS queues (IAM grants)
-     * - ConnectionConfig: Explicit access level configuration
-     *
-     * @example
-     * // Simple connections (default permissions)
-     * connections: [database, bucket, cache, queue]
-     *
-     * @example
-     * // Explicit access levels
-     * connections: [
-     *   database,                              // Security group (RDS)
-     *   { resource: cache, access: "read" },   // Read-only DynamoDB
-     *   { resource: bucket, access: "write" }, // Write-only S3
-     *   { resource: queue, access: "consume" } // Consume-only SQS
-     * ]
-     */
-    connections?: ConnectionSpec[];
-    /**
-     * Capacity provider for this service. REQUIRED.
-     * Each service specifies its own capacity provider.
-     *
-     * @example
-     * // Mixed FARGATE and EC2 services in same cluster
-     * {
-     *   services: [
-     *     { name: "api", capacityProvider: "FARGATE" },
-     *     { name: "worker", capacityProvider: "EC2", ec2Config: { instanceType: "t4g.micro" } }
-     *   ]
-     * }
-     */
-    capacityProvider: EcsCapacityProvider;
-    /**
-     * EC2 capacity configuration for this service.
-     * Only used when service capacityProvider is "EC2".
-     * Services with matching ec2Config share an ASG for efficiency.
-     */
-    ec2Config?: Ec2CapacityConfig;
-    /**
-     * SSM Parameter Store path for secrets.
-     * If not specified, secrets are fetched from /<app>/<cluster>/<service>.
-     * Use this to override the default convention.
-     *
-     * @example
-     * // Override default path
-     * ssmSecretsPath: "/custom/path/to/secrets"
-     */
-    ssmSecretsPath?: string;
-    /**
-     * Per-service alarm configuration.
-     * - undefined: use defaults (CPU, memory, running tasks, 5xx if ALB)
-     * - false: disable alarms for this service
-     * - object: override specific thresholds
-     */
-    alarms?: EcsServiceAlarmThresholds | false;
-}
-/**
- * ECS compute configuration.
- * Creates an ECS cluster with one or more services sharing a load balancer.
- *
- * @example
- * // Single service
- * app.addCompute(ComputeFactory.build("WebApp", {
- *   type: "ecs",
- *   cluster: { domain: "app.example.com" },
- *   services: [{ name: "web", containers: [{ port: 3000 }] }]
- * }));
- *
- * @example
- * // Multi-service cluster with routing
- * app.addCompute(ComputeFactory.build("ApiCluster", {
- *   type: "ecs",
- *   cluster: { domain: "api.example.com" },
- *   services: [
- *     { name: "users", containers: [{ port: 3000 }], routing: { path: "/users/*" } },
- *     { name: "orders", containers: [{ port: 3001 }], routing: { path: "/orders/*" } }
- *   ]
- * }));
- *
- * @example
- * // Internal workers (no ALB)
- * app.addCompute(ComputeFactory.build("Workers", {
- *   type: "ecs",
- *   cluster: { loadBalancer: false },
- *   services: [{ name: "processor" }, { name: "emailer" }]
- * }));
- */
-export interface EcsComputeProps {
-    type: "ecs";
-    vpc?: IVpc;
-    /**
-     * Application name for SSM secrets namespace.
-     * When containers use secrets, the path is derived as: /<appName>/<clusterName>/<serviceName>
-     * Auto-derived from App.getName() if not specified.
-     */
-    appName?: string;
-    /**
-     * Cluster configuration.
-     * Controls the shared ALB for all services in this cluster.
-     * - Omit: ALB created with default settings
-     * - `{ domain: "..." }`: ALB with HTTPS + DNS
-     * - `{ loadBalancer: false }`: No ALB (internal workers)
-     */
-    cluster?: EcsClusterConfig;
-    /**
-     * Services in this cluster.
-     * Each service gets its own task definition, scaling, and target group.
-     * Each service MUST specify its own capacityProvider.
-     * All services share the cluster's ALB (unless disabled).
-     */
-    services: EcsServiceConfig[];
-    /**
-     * ECR repository for all services (default image).
-     * Individual services can override with their own `image` property.
-     */
-    ecrRepository?: Repository | RepositoryImage;
-    /**
-     * Path to Dockerfile for building custom image.
-     * Note: This is metadata for the CLI build process,
-     * not used during CDK synthesis.
-     */
-    dockerfilePath?: string;
-    /**
-     * SNS topic for alarm notifications. Resolved to ITopic and passed to EcsCluster.
-     * Accepts either an ITopic directly or a topic ARN string (resolved internally).
-     */
-    alertsTopic?: ITopic | string;
-    /** Application ID for alarm tagging (used by webhook to map alarms to applications). */
-    applicationId?: string;
-}
 /**
  * Validates ECS-specific props.
  * Extracted for clarity and detail parity with database/network patterns.
@@ -449,6 +59,7 @@ export declare class EcsCompute extends Construct implements IEcsCompute {
      * Get the ALB listener if this is an ECS compute with ALB.
      */
     getListener(): ApplicationListener | undefined;
+    getPrimaryListenerPort(): number | undefined;
     /**
      * Get the underlying ECS cluster construct.
      */

package/dist/lib/patterns/aws/computeEcs.js

@@ -2,11 +2,12 @@ import { Grant } from "aws-cdk-lib/aws-iam";
 import { Fn } from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { Topic } from "aws-cdk-lib/aws-sns";
-import EcsCluster, { ScalingType } from "../../resources/aws/compute/ecs.js";
+import EcsCluster from "../../resources/aws/compute/ecs.js";
 import { FjallLogger } from "../../utils/validationLogger.js";
+import { VALIDATION_PATTERNS } from "@fjall/generator";
 import { COMPUTE_DEFAULTS } from "./compute.js";
-// Re-export from ecs.ts to maintain single source of truth
-export { ScalingType };
+export { ScalingType } from "./computeEcsTypes.js";
+import { ScalingType } from "./computeEcsTypes.js";
 export const ECS_CAPACITY_PROVIDER_CONFIG = {
     FARGATE: {
         usesSpot: false,
@@ -40,7 +41,7 @@ export function validateEcsProps(props) {
         throw new Error(`Duplicate service names: ${[...new Set(duplicateNames)].join(", ")}`);
     }
     // Validate service name format
-    const invalidNames = props.services.filter((s) => !/^[a-zA-Z][a-zA-Z0-9-]*$/.test(s.name));
+    const invalidNames = props.services.filter((s) => !VALIDATION_PATTERNS.ECS_SERVICE_NAME.test(s.name));
     if (invalidNames.length > 0) {
         throw new Error(`Invalid service names: ${invalidNames.map((s) => s.name).join(", ")}. ` +
             "Service names must start with a letter and contain only letters, numbers, and hyphens.");
@@ -163,6 +164,7 @@ export class EcsCompute extends Construct {
                 taskRoleInlinePolicies: service.taskRoleInlinePolicies,
                 taskRoleManagedPolicies: service.taskRoleManagedPolicies,
                 connections: service.connections,
+                remoteConnections: service.remoteConnections,
                 capacityProvider: service.capacityProvider,
                 ec2Config: service.ec2Config,
                 ssmSecretsPath: service.ssmSecretsPath,
@@ -200,7 +202,7 @@ export class EcsCompute extends Construct {
             alertsTopic: resolvedAlertsTopic,
             applicationId: props.applicationId
         };
-        this.ecsCluster = new EcsCluster(scope, `${id}Ecs`, ecsProps);
+        this.ecsCluster = new EcsCluster(this, `${id}Ecs`, ecsProps);
         this.connections = this.ecsCluster.connections;
     }
     /** Get the ECS cluster. */
@@ -222,12 +224,11 @@ export class EcsCompute extends Construct {
     }
     /** Get the security group for the cluster. */
     getSecurityGroup() {
-        // Return the first security group from connections
-        const securityGroups = this.connections.securityGroups;
-        if (securityGroups.length === 0) {
+        const sg = this.connections.securityGroups[0];
+        if (!sg) {
             throw new Error("No security groups found for ECS cluster");
         }
-        return securityGroups[0];
+        return sg;
     }
     /**
      * Get the ALB listener if this is an ECS compute with ALB.
@@ -235,6 +236,9 @@ export class EcsCompute extends Construct {
     getListener() {
         return this.ecsCluster.getListener();
     }
+    getPrimaryListenerPort() {
+        return this.getListener()?.port;
+    }
     /**
      * Get the underlying ECS cluster construct.
      */