@fjall/components-infrastructure 2.34.0 → 3.1.0

package/dist/lib/app.d.ts

@@ -3,7 +3,7 @@ import { type CloudAssembly } from "aws-cdk-lib/cx-api";
 import { type Construct } from "constructs";
 import { type IVpc } from "aws-cdk-lib/aws-ec2";
 import { type Role } from "aws-cdk-lib/aws-iam";
-import { AwsStack } from "./resources/index.js";
+import { AwsStack, type AwsStackProps } from "./resources/index.js";
 import { type Ecr } from "./resources/aws/storage/ecr.js";
 import { type AnyDatabase } from "./patterns/aws/database.js";
 import { type INetworkProps, type Network } from "./patterns/aws/network.js";
@@ -16,6 +16,7 @@ import { type RemovalPolicyString } from "./resources/aws/messaging/utils.js";
 import { type ServiceRegistrationProps } from "./resources/aws/networking/serviceDiscovery.js";
 import { type IPrivateDnsNamespace, type IService } from "aws-cdk-lib/aws-servicediscovery";
 import { type AnyCompute } from "./patterns/aws/compute.js";
+import { Buildkite, type BuildkitePropsInput } from "./patterns/aws/buildkite.js";
 import { DevSubstrate, type IDevSubstrateProps } from "./patterns/aws/devSubstrate.js";
 import { type Storage, type StorageFactoryFn } from "./patterns/aws/storage.js";
 import { type AnyPattern, type PatternFactoryFn } from "./patterns/aws/pattern.js";
@@ -123,8 +124,10 @@ export declare class App extends CdkApp {
      *
      * @param key - The key of the stack
      * @param dependencies - The stack(s) that this stack depends on
+     * @param props - Stack props applied on first creation only (cached
+     *                stacks are returned as-is)
      */
-    getStack(key: string, dependencies?: AwsStack | AwsStack[]): AwsStack;
+    getStack(key: string, dependencies?: AwsStack | AwsStack[], props?: AwsStackProps): AwsStack;
     /**
      * Retrieve default compute stack - named as `${this.name}Compute`
      *
@@ -162,6 +165,21 @@ export declare class App extends CdkApp {
      * require VPC, but we maintain consistent stack dependency patterns.
      */
     getDefaultMessagingStack(): AwsStack;
+    /**
+     * Retrieve the app-owned us-east-1 certificate stack — named
+     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     *
+     * CloudFront accepts viewer certificates from us-east-1 only, so
+     * CloudFront-consuming patterns (staticsite, payload) whose app deploys to
+     * another region provision their DomainCertificate here; the distribution
+     * in the Cdn stack consumes the ARN through CDK cross-region references.
+     *
+     * `crossRegionReferences: true` must be set on BOTH the producing and the
+     * consuming stack; both get it at construction (the Cdn stack in
+     * getDefaultCdnStack, this stack here) and the emitted
+     * Custom::CrossRegionExportWriter/Reader pair is pinned by template test.
+     */
+    getUsEast1CertificateStack(): AwsStack;
     /**
      * Get a VPC by name. If no name is provided, returns the default VPC.
      *
@@ -260,6 +278,22 @@ export declare class App extends CdkApp {
      * would synth and hash but never deploy.
      */
     addDevSubstrate(props: IDevSubstrateProps): DevSubstrate;
+    /**
+     * Instantiate the self-hosted Buildkite agent fleet on the default compute
+     * stack (design `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`).
+     *
+     * Same placement contract as `addDevSubstrate` above: deploy-core selects
+     * stacks by the fixed six-category enum, so scoping under
+     * `${stackPrefix}Compute` is what makes the fleet actually deploy. Also the
+     * same registry posture — Fjall-managed platform infrastructure,
+     * deliberately NOT on the customer create/scaffold surface (design § D3).
+     *
+     * Cost-allocation environment resolves from `getConfig()` (design § D10) so
+     * the fleet's environment tag matches the deploying config rather than the
+     * construct's `management` fallback; an explicit
+     * `props.costAllocationEnvironment` still wins.
+     */
+    addBuildkite(props: BuildkitePropsInput): Buildkite;
     /**
      * Add a database resource to the default database stack using the factory pattern.
      * Returns the appropriate database type based on the factory used.

package/dist/lib/app.js

@@ -9,15 +9,18 @@ import { NetworkFactory } from "./patterns/aws/network.js";
 import { MessagingFactory } from "./patterns/aws/messaging.js";
 import { Schedule } from "./resources/aws/messaging/schedule.js";
 import { ServiceDiscoveryNamespace } from "./resources/aws/networking/serviceDiscovery.js";
+import { Buildkite } from "./patterns/aws/buildkite.js";
 import { DevSubstrate } from "./patterns/aws/devSubstrate.js";
 import { StandardTagsAspect } from "./utils/standardTagsAspect.js";
 import { BACKUP_TIER_TAG_KEY, BACKUP_TIER_TAG_MAP } from "./utils/backupTierMapping.js";
 import { randomBytes } from "crypto";
 import { getConfig } from "./utils/getConfig.js";
+import { UNKNOWN_ENVIRONMENT } from "./utils/env.js";
 import AuditRoleFactory from "./resources/aws/audit/auditRole.js";
 import { FJALL_AUDIT_CONFIG } from "./config/audit.js";
 import { FjallLogger } from "./utils/validationLogger.js";
 import { getManifestCollector, writeManifest } from "./utils/manifestWriter.js";
+import { resetDnsRecordRegistry } from "./utils/dnsRecordRegistry.js";
 import { toPascalCase, toKebab } from "./utils/capitaliseString.js";
 import { COST_ALLOCATION_TAGS } from "./utils/costAllocationTags.js";
 import { DEFAULT_ORG_ID, resolveOrgId } from "./utils/cdkContext.js";
@@ -168,6 +171,10 @@ export class App extends CdkApp {
     }
     static resetForTesting() {
         App.instance = null;
+        // App-scoped synth state resets with the App singleton — the DNS
+        // record-collision registry (D5) follows the manifest-collector lifecycle
+        // without requiring a third per-test reset call.
+        resetDnsRecordRegistry();
     }
     /**
      * Retrieve a stack by key. If the stack does not exist, it will be created.
@@ -175,8 +182,10 @@ export class App extends CdkApp {
      *
      * @param key - The key of the stack
      * @param dependencies - The stack(s) that this stack depends on
+     * @param props - Stack props applied on first creation only (cached
+     *                stacks are returned as-is)
      */
-    getStack(key, dependencies) {
+    getStack(key, dependencies, props) {
         // Apply the aspect once before creating the first stack
         if (!this.aspectApplied &&
             Object.keys(this.stacks).length === 0 &&
@@ -184,7 +193,7 @@ export class App extends CdkApp {
             this.applyTagsAspect();
         }
         if (!this.stacks[key]) {
-            this.stacks[key] = new AwsStack(key, dependencies);
+            this.stacks[key] = new AwsStack(key, dependencies, props);
         }
         return this.stacks[key];
     }
@@ -225,7 +234,10 @@ export class App extends CdkApp {
      * stack is synthesised.
      */
     getDefaultCdnStack() {
-        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDisabled ? undefined : this.getDefaultNetworkStack());
+        // crossRegionReferences is enabled at creation so the Cdn stack can
+        // consume a us-east-1 certificate (domain gold-plating D3, BYO path).
+        // The flag is inert unless a cross-region reference is synthesised.
+        return this.getStack(`${this.stackPrefix}Cdn`, this.networkDisabled ? undefined : this.getDefaultNetworkStack(), { crossRegionReferences: true });
     }
     /**
      * Retrieve default messaging stack - named as `${this.name}Messaging`
@@ -237,6 +249,39 @@ export class App extends CdkApp {
     getDefaultMessagingStack() {
         return this.getStack(`${this.stackPrefix}Messaging`, this.getDefaultNetworkStack());
     }
+    /**
+     * Retrieve the app-owned us-east-1 certificate stack — named
+     * `${this.name}UsEast1Certificates` (domain gold-plating D3, BYO path).
+     *
+     * CloudFront accepts viewer certificates from us-east-1 only, so
+     * CloudFront-consuming patterns (staticsite, payload) whose app deploys to
+     * another region provision their DomainCertificate here; the distribution
+     * in the Cdn stack consumes the ARN through CDK cross-region references.
+     *
+     * `crossRegionReferences: true` must be set on BOTH the producing and the
+     * consuming stack; both get it at construction (the Cdn stack in
+     * getDefaultCdnStack, this stack here) and the emitted
+     * Custom::CrossRegionExportWriter/Reader pair is pinned by template test.
+     */
+    getUsEast1CertificateStack() {
+        const key = `${this.stackPrefix}UsEast1Certificates`;
+        if (!this.stacks[key]) {
+            const account = process.env.CDK_DEFAULT_ACCOUNT;
+            if (!account) {
+                throw new Error(`App '${this.name}': the us-east-1 certificate stack needs a ` +
+                    "concrete account (got CDK_DEFAULT_ACCOUNT undefined). " +
+                    "Cross-region references resolve only between env-pinned stacks " +
+                    "— deploy through the Fjall CLI, or export CDK_DEFAULT_ACCOUNT " +
+                    "and CDK_DEFAULT_REGION before synthesising.");
+            }
+            this.stacks[key] = new AwsStack(key, undefined, {
+                accountId: account,
+                region: "us-east-1",
+                crossRegionReferences: true
+            });
+        }
+        return this.stacks[key];
+    }
     /**
      * Get a VPC by name. If no name is provided, returns the default VPC.
      *
@@ -437,6 +482,36 @@ export class App extends CdkApp {
         computeStack.addConstruct(substrate);
         return substrate;
     }
+    /**
+     * Instantiate the self-hosted Buildkite agent fleet on the default compute
+     * stack (design `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`).
+     *
+     * Same placement contract as `addDevSubstrate` above: deploy-core selects
+     * stacks by the fixed six-category enum, so scoping under
+     * `${stackPrefix}Compute` is what makes the fleet actually deploy. Also the
+     * same registry posture — Fjall-managed platform infrastructure,
+     * deliberately NOT on the customer create/scaffold surface (design § D3).
+     *
+     * Cost-allocation environment resolves from `getConfig()` (design § D10) so
+     * the fleet's environment tag matches the deploying config rather than the
+     * construct's `management` fallback; an explicit
+     * `props.costAllocationEnvironment` still wins.
+     */
+    addBuildkite(props) {
+        const computeStack = this.getDefaultComputeStack();
+        const configEnvironment = getConfig().environment;
+        const constructProps = { ...props, vpc: this.getVpc() };
+        // Post-spread injection so a caller-materialised `costAllocationEnvironment:
+        // undefined` counts as absent rather than clobbering the resolved value.
+        if (constructProps.costAllocationEnvironment === undefined &&
+            configEnvironment !== "" &&
+            configEnvironment !== UNKNOWN_ENVIRONMENT) {
+            constructProps.costAllocationEnvironment = configEnvironment;
+        }
+        const fleet = new Buildkite(computeStack.getStack(), "Buildkite", constructProps);
+        computeStack.addConstruct(fleet);
+        return fleet;
+    }
     /**
      * Add a database resource to the default database stack using the factory pattern.
      * Returns the appropriate database type based on the factory used.

package/dist/lib/patterns/aws/apexDomainPattern.d.ts

@@ -1,26 +1,25 @@
 import type { Construct } from "constructs";
 import type { IHostedZone } from "aws-cdk-lib/aws-route53";
 import type { ICertificate } from "aws-cdk-lib/aws-certificatemanager";
-import type { ManualRecord, Route53ApexProps, SubdomainDelegation } from "./interfaces/domain.js";
+import type { ManualRecord, Route53ApexProps } from "./interfaces/domain.js";
 export interface ApexDomainPatternResult {
     readonly hostedZone: IHostedZone;
     readonly certificates: Map<string, ICertificate>;
     readonly nameServers: string[] | undefined;
     readonly manualRecords: ManualRecord[];
-    readonly delegations: SubdomainDelegation[];
 }
 /**
  * Composition for `registrar: "route53"`. Creates (or imports) the apex
- * `HostedZone`, wires child-account delegations via `NsRecord` (pointing at
- * each child's nameservers published as exports), and composes all user
- * records + certificates.
+ * `HostedZone` and composes all user records + certificates.
  *
- * Delegation mechanism: the child Fjall account scaffolds its own
- * `HostedZone`, and the parent simply writes NS records pointing at the
- * child's nameservers (Fn.importValue of the child stack's nameservers
- * output). This differs from the legacy `DomainDelegation` pattern, which
- * uses `CrossAccountZoneDelegationRecord` to create the child HZ from the
- * parent via IAM assume-role. Both patterns are valid for their respective
- * semantics — see R10 in the Phase 1 plan.
+ * Delegation direction (D8): child writes NS. The apex zone's contribution
+ * to delegation is the org-gated `DelegationRole` the `HostedZone` wrapper
+ * creates on the create path — the delegated child `Domain` assumes that
+ * role by LITERAL ARN (`parentDelegationRoleArn`) and UPSERTs its own NS
+ * records into this zone via `CrossAccountZoneDelegationRecord`. The old
+ * parent-writes `delegations[]` path (NS records from `Fn.importValue` of
+ * child nameserver exports) was removed with the H13 legacy layer: it was
+ * export-locked, child-first-deploy-ordered, and removal required a parent
+ * redeploy.
  */
 export declare function composeApexDomain(scope: Construct, props: Route53ApexProps): ApexDomainPatternResult;

package/dist/lib/patterns/aws/apexDomainPattern.js

@@ -1,24 +1,21 @@
-import { Fn } from "aws-cdk-lib";
-import { getDomainExportNames } from "@fjall/util";
 import { HostedZone } from "../../resources/aws/networking/hostedZone.js";
 import { DomainCertificate } from "../../resources/aws/networking/domainCertificate.js";
-import { NsRecord } from "../../resources/aws/networking/dnsRecord/index.js";
 import { composeTypedDnsRecords } from "./dnsRecordComposer.js";
 import { toPascalCase, getSafeZoneName } from "../../utils/capitaliseString.js";
 import { resolveOrgId } from "../../utils/cdkContext.js";
 /**
  * Composition for `registrar: "route53"`. Creates (or imports) the apex
- * `HostedZone`, wires child-account delegations via `NsRecord` (pointing at
- * each child's nameservers published as exports), and composes all user
- * records + certificates.
+ * `HostedZone` and composes all user records + certificates.
  *
- * Delegation mechanism: the child Fjall account scaffolds its own
- * `HostedZone`, and the parent simply writes NS records pointing at the
- * child's nameservers (Fn.importValue of the child stack's nameservers
- * output). This differs from the legacy `DomainDelegation` pattern, which
- * uses `CrossAccountZoneDelegationRecord` to create the child HZ from the
- * parent via IAM assume-role. Both patterns are valid for their respective
- * semantics — see R10 in the Phase 1 plan.
+ * Delegation direction (D8): child writes NS. The apex zone's contribution
+ * to delegation is the org-gated `DelegationRole` the `HostedZone` wrapper
+ * creates on the create path — the delegated child `Domain` assumes that
+ * role by LITERAL ARN (`parentDelegationRoleArn`) and UPSERTs its own NS
+ * records into this zone via `CrossAccountZoneDelegationRecord`. The old
+ * parent-writes `delegations[]` path (NS records from `Fn.importValue` of
+ * child nameserver exports) was removed with the H13 legacy layer: it was
+ * export-locked, child-first-deploy-ordered, and removal required a parent
+ * redeploy.
  */
 export function composeApexDomain(scope, props) {
     const safeZone = toPascalCase(getSafeZoneName(props.zoneName));
@@ -51,22 +48,6 @@ export function composeApexDomain(scope, props) {
     if (props.records && props.records.length > 0) {
         composeTypedDnsRecords(scope, hostedZoneConstruct.hostedZone, props.zoneName, props.records);
     }
-    const delegations = props.delegations ?? [];
-    delegations.forEach((delegation, index) => {
-        const childZoneName = `${delegation.subdomain}.${props.zoneName}`;
-        const safeChild = toPascalCase(getSafeZoneName(childZoneName));
-        const childExports = getDomainExportNames(childZoneName);
-        // Cross-phase dependency: child stack must deploy first; CFN fails here
-        // at deploy if the nameservers export does not yet exist.
-        const nameserversToken = Fn.importValue(childExports.nameservers);
-        new NsRecord(scope, `${safeZone}Delegation${safeChild}${index}`, {
-            zone: hostedZoneConstruct.hostedZone,
-            zoneName: props.zoneName,
-            recordName: delegation.subdomain,
-            // Fn.split returns a list token suitable for a multi-value NS record.
-            values: Fn.split(",", nameserversToken)
-        });
-    });
     return {
         hostedZone: hostedZoneConstruct.hostedZone,
         certificates,
@@ -75,8 +56,7 @@ export function composeApexDomain(scope, props) {
         nameServers: hostedZoneConstruct.isImported
             ? undefined
             : (hostedZoneConstruct.nameServers ?? undefined),
-        manualRecords: [],
-        delegations
+        manualRecords: []
     };
 }
 function normaliseCertificate(cert) {

package/dist/lib/patterns/aws/buildkite/alarms.d.ts

@@ -0,0 +1,20 @@
+import type { Construct } from "constructs";
+export interface BuildkiteAlarmParams {
+    readonly buildkiteOrgSlug: string;
+    readonly buildkiteQueue: string;
+    readonly autoScalingGroupName: string;
+    readonly alarmSnsTopicArn?: string;
+}
+/**
+ * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
+ * posture is honest only with these:
+ *
+ * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
+ *    The scaler publishes every poll, so metric absence means the scaler
+ *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
+ *    entire mechanism.
+ * 2. Queued with zero capacity — jobs scheduled while the ASG has no
+ *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
+ *    quota, subnet failure) while work is waiting.
+ */
+export declare function addBuildkiteAlarms(scope: Construct, params: BuildkiteAlarmParams): void;

package/dist/lib/patterns/aws/buildkite/alarms.js

@@ -0,0 +1,78 @@
+import { Duration } from "aws-cdk-lib";
+import { Alarm, ComparisonOperator, MathExpression, Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
+import { Topic } from "aws-cdk-lib/aws-sns";
+/**
+ * Metrics namespace the buildkite-agent-scaler publishes to, dimensioned by
+ * {Org, Queue} — BOTH dimensions are required; querying Queue alone reads no
+ * data (CloudWatch dimension matching is exact-set), leaving the heartbeat
+ * permanently ALARM and the queued alarm permanently inert. Phase-1b rollout
+ * gate: verify both metrics carry data after the first build before trusting
+ * the alarms (design § D13/D14) — a namespace/dimension mismatch here is
+ * invisible to the synth tests.
+ */
+const SCALER_METRICS_NAMESPACE = "Buildkite";
+/**
+ * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
+ * posture is honest only with these:
+ *
+ * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
+ *    The scaler publishes every poll, so metric absence means the scaler
+ *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
+ *    entire mechanism.
+ * 2. Queued with zero capacity — jobs scheduled while the ASG has no
+ *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
+ *    quota, subnet failure) while work is waiting.
+ */
+export function addBuildkiteAlarms(scope, params) {
+    const scheduledJobs = new Metric({
+        namespace: SCALER_METRICS_NAMESPACE,
+        metricName: "ScheduledJobsCount",
+        dimensionsMap: {
+            Org: params.buildkiteOrgSlug,
+            Queue: params.buildkiteQueue
+        },
+        statistic: "Maximum",
+        period: Duration.minutes(5)
+    });
+    const heartbeatAlarm = new Alarm(scope, "ScalerHeartbeatAlarm", {
+        alarmDescription: `Buildkite scaler for queue '${params.buildkiteQueue}' has stopped ` +
+            "publishing metrics — scaler Lambda dead or erroring. Jobs will queue " +
+            "with no scale-out.",
+        metric: scheduledJobs,
+        comparisonOperator: ComparisonOperator.LESS_THAN_THRESHOLD,
+        threshold: 0,
+        evaluationPeriods: 3,
+        treatMissingData: TreatMissingData.BREACHING
+    });
+    const inServiceInstances = new Metric({
+        namespace: "AWS/AutoScaling",
+        metricName: "GroupInServiceInstances",
+        dimensionsMap: { AutoScalingGroupName: params.autoScalingGroupName },
+        statistic: "Maximum",
+        period: Duration.minutes(5)
+    });
+    const queuedWithZeroCapacity = new MathExpression({
+        expression: "IF(scheduled > 0 AND inService == 0, 1, 0)",
+        usingMetrics: {
+            scheduled: scheduledJobs,
+            inService: inServiceInstances
+        },
+        period: Duration.minutes(5)
+    });
+    const queuedAlarm = new Alarm(scope, "QueuedWithZeroCapacityAlarm", {
+        alarmDescription: `Buildkite queue '${params.buildkiteQueue}' has scheduled jobs but ` +
+            "zero in-service agents for 15 minutes — the fleet cannot boot " +
+            "(AMI, quota, or subnet failure) while work waits.",
+        metric: queuedWithZeroCapacity,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 1,
+        evaluationPeriods: 3,
+        treatMissingData: TreatMissingData.NOT_BREACHING
+    });
+    if (params.alarmSnsTopicArn !== undefined) {
+        const topic = Topic.fromTopicArn(scope, "BuildkiteAlarmTopic", params.alarmSnsTopicArn);
+        heartbeatAlarm.addAlarmAction(new SnsAction(topic));
+        queuedAlarm.addAlarmAction(new SnsAction(topic));
+    }
+}

package/dist/lib/patterns/aws/buildkite/buildkite.d.ts

@@ -0,0 +1,46 @@
+import { type IVpc } from "aws-cdk-lib/aws-ec2";
+import { Construct } from "constructs";
+import { type BuildkitePropsInput } from "./schema.js";
+export type BuildkiteConstructProps = BuildkitePropsInput & {
+    readonly vpc: IVpc;
+};
+/**
+ * Self-hosted Buildkite agent fleet on the pinned Elastic CI Stack AMIs —
+ * scale-to-zero ASG + buildkite-agent-scaler, no secret ever transiting
+ * synth, allowlist-only instance IAM. Design:
+ * `aiDocs/designs/2026-07-18-buildkite-selfhosted-agents.md`.
+ *
+ * A Construct, not a Stack: instantiate via `App.addBuildkite(props)`, which
+ * scopes it under the default compute stack so deploy-core's fixed
+ * six-category stack selection actually deploys it (the DevSubstrate
+ * placement precedent). Network posture is public-subnet + public-IP +
+ * zero-ingress (design § D5): `associatePublicIpAddress` MUST be explicit —
+ * the wrapper's `!!keyPair` default silently produced no-egress agents in
+ * public subnets pre-refactor.
+ */
+export declare class Buildkite extends Construct {
+    readonly artifactBucketName: string;
+    readonly secretsBucketName: string;
+    readonly autoScalingGroupName: string;
+    constructor(scope: Construct, id: string, props: BuildkiteConstructProps);
+    /**
+     * Ship the per-job `env` hook into the managed secrets bucket. The
+     * s3-secrets-hooks plugin sources this file at the start of EVERY job, so
+     * FJALL_API_KEY is read fresh from SSM per job — rotation takes effect on
+     * the next job with no instance replacement (design § D4(iii)). The script
+     * is configuration, not a secret: shipping it through a CDK asset is fine;
+     * the secret VALUE only ever moves SSM → instance at job runtime.
+     */
+    private addFjallApiKeyEnvHook;
+}
+/**
+ * Object key the s3-secrets-hooks plugin sources at the start of every job —
+ * upstream contract: `env` at the secrets-bucket root.
+ */
+export declare const FJALL_ENV_HOOK_OBJECT_KEY = "env";
+/**
+ * The per-job env hook's script content (design § D4(iii)): FJALL_API_KEY is
+ * read fresh from SSM per job, so rotation takes effect on the next job with
+ * no instance replacement. Pure — the unit test pins the exact content.
+ */
+export declare function buildFjallApiKeyEnvHookScript(parameterName: string, region: string): string;