@fjall/components-infrastructure 10.1.2 → 10.1.3

package/dist/lib/resources/aws/compute/ecsConstants.d.ts

@@ -41,6 +41,19 @@ export declare const DEFAULT_ROLLING_UPDATE_PAUSE_SECONDS = 300;
 export declare function resolveEc2ContainerMemoryMiB(ec2Config: {
     readonly memoryLimitMiB?: number;
 } | undefined): number;
+/**
+ * Hard memory limit for the synthetic `fjall-schema-gate` container on
+ * EC2-capacity services. The gate is a run-to-completion Node probe (a
+ * handful of DB queries, then exit) — giving it the service's full
+ * `ec2Config.memoryLimitMiB` doubles the task's placement requirement and
+ * can exceed the instance's registered memory entirely: with the 2048 MiB
+ * deploy-worker limit the task demanded 4096 MiB against a t4g.medium's
+ * 3835, making every task structurally unplaceable (2026-08-12 production
+ * wedge — armed silently at desiredCount 0, detonated on the first
+ * queue-driven scale-up mid-CFN-update). Fargate services are unaffected:
+ * their memory is task-level, so the gate shares the task envelope.
+ */
+export declare const SCHEMA_GATE_CONTAINER_MEMORY_MIB = 512;
 export declare const DEFAULT_ECS_FALLBACK_IMAGE = "amazon/amazon-ecs-sample";
 export declare const DEFAULT_CUSTOM_RESOURCE_TIMEOUT_SECONDS = 300;
 export declare const DEFAULT_HEALTH_CHECK_GRACE_SECONDS = 120;

package/dist/lib/resources/aws/compute/ecsConstants.js

@@ -54,6 +54,19 @@ export const DEFAULT_ROLLING_UPDATE_PAUSE_SECONDS = 300;
 export function resolveEc2ContainerMemoryMiB(ec2Config) {
     return ec2Config?.memoryLimitMiB ?? DEFAULT_EC2_CONTAINER_MEMORY_MIB;
 }
+/**
+ * Hard memory limit for the synthetic `fjall-schema-gate` container on
+ * EC2-capacity services. The gate is a run-to-completion Node probe (a
+ * handful of DB queries, then exit) — giving it the service's full
+ * `ec2Config.memoryLimitMiB` doubles the task's placement requirement and
+ * can exceed the instance's registered memory entirely: with the 2048 MiB
+ * deploy-worker limit the task demanded 4096 MiB against a t4g.medium's
+ * 3835, making every task structurally unplaceable (2026-08-12 production
+ * wedge — armed silently at desiredCount 0, detonated on the first
+ * queue-driven scale-up mid-CFN-update). Fargate services are unaffected:
+ * their memory is task-level, so the gate shares the task envelope.
+ */
+export const SCHEMA_GATE_CONTAINER_MEMORY_MIB = 512;
 // AWS sample image used when no ECR repository is provided. Consumed by both
 // the resources/ image resolver and the patterns/ defaults block — keep them
 // in lockstep via this single export.

package/dist/lib/resources/aws/compute/ecsTaskDefinition.js

@@ -4,9 +4,10 @@ import { Secret as EcsSecret } from "aws-cdk-lib/aws-ecs";
 import { StringParameter } from "aws-cdk-lib/aws-ssm";
 import { buildParameterPath } from "@fjall/util";
 import { DEFAULT_ALB_IDLE_TIMEOUT_SECONDS, FJALL_ALB_IDLE_TIMEOUT_ENV_VAR } from "@fjall/util/httpKeepAlive";
+import { SCHEMA_GATE_CONTAINER_NAME } from "@fjall/util/migration";
 import { resolveOrgId } from "../../../utils/cdkContext.js";
 import { validateSsmPathComponent, validateSecretName } from "./ecsValidation.js";
-import { DEFAULT_LOG_RETENTION, DEFAULT_FARGATE_CPU, DEFAULT_FARGATE_MEMORY_MIB, resolveEc2ContainerMemoryMiB } from "./ecsConstants.js";
+import { DEFAULT_LOG_RETENTION, DEFAULT_FARGATE_CPU, DEFAULT_FARGATE_MEMORY_MIB, resolveEc2ContainerMemoryMiB, SCHEMA_GATE_CONTAINER_MEMORY_MIB } from "./ecsConstants.js";
 import { LogGroup } from "../logging/logGroup.js";
 import { getContainerImage } from "./ecsImages.js";
 import { resolveRemoteConnections } from "./ecsRemoteConnections.js";
@@ -230,8 +231,13 @@ export function addContainersToTask(ctx, serviceName, serviceProps, taskDefiniti
             startTimeout: containerConfig.startTimeout !== undefined
                 ? Duration.seconds(containerConfig.startTimeout)
                 : undefined,
+            // EC2 placement demands the SUM of container hard limits — the gate
+            // probe must not inherit the service's full per-container limit (see
+            // SCHEMA_GATE_CONTAINER_MEMORY_MIB; the gate name is synth-reserved).
             ...(isServiceEc2(serviceProps) && {
-                memoryLimitMiB: resolveEc2ContainerMemoryMiB(serviceProps.ec2Config)
+                memoryLimitMiB: containerConfig.name === SCHEMA_GATE_CONTAINER_NAME
+                    ? SCHEMA_GATE_CONTAINER_MEMORY_MIB
+                    : resolveEc2ContainerMemoryMiB(serviceProps.ec2Config)
             })
         });
         if (containerConfig.port !== undefined &&

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "10.1.2",
+  "version": "10.1.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -80,8 +80,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^10.1.2",
-    "@fjall/util": "^10.1.2",
+    "@fjall/generator": "^10.1.3",
+    "@fjall/util": "^10.1.3",
     "constructs": "^10.7.2"
   },
   "overrides": {