@fjall/components-infrastructure 39.0.5 → 39.0.6

package/dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs

@@ -1,15 +1,30 @@
 /**
- * ECS deployment lifecycle hook (PRE_SCALE_UP) runner. Inlined into a Lambda
- * at synth time by ecsLifecycleHookMigration.ts.
+ * ECS deployment lifecycle hook (PRE_SCALE_UP or POST_SCALE_UP) runner.
+ * Inlined into a Lambda at synth time by ecsLifecycleHookMigration.ts.
+ *
+ * Everything the hook runs comes from the deployment it serves, never from
+ * the Lambda's own configuration (FJL-901). ECS names the deployment's target
+ * service revision; the revision gives the cluster, the service's task
+ * definition and its network configuration; the service's task definition
+ * names the migration task definition in its fjall:migration-task-definition
+ * tag, or, on a revision registered by copying another (whose tags the copy
+ * drops), in its primary container's io.fjall.migration-task-definition
+ * docker label; and the migration task definition carries its own command,
+ * entry point and environment, plus, when the migration has security groups
+ * of its own, their ids in its fjall:migration-security-groups tag. So the hook
+ * never runs one release's migration for another release's code, however its
+ * own update and the service's are ordered. The Lambda changes only when its
+ * code does.
  *
  * Re-invocation safety: ECS hook responses do NOT carry state between
  * IN_PROGRESS invocations. On every invocation we reconstruct the
  * deterministic startedBy tag from the event's
- * executionDetails.targetServiceRevisionArn and use ListTasks to find an
- * existing running migration. RunTask fires only on the first invocation.
+ * executionDetails.targetServiceRevisionArn and use ListTasks to find the
+ * migration task already started for it, running or stopped. RunTask fires
+ * only when there is none.
  *
  * Event contract: the target revision ARN is nested under `executionDetails`
- * and the `executionId` is top-level — see AWS "Lambda hooks for Amazon ECS
+ * and the `executionId` is top-level - see AWS "Lambda hooks for Amazon ECS
  * service deployments" (developerguide/lambda-lifecycle-hooks.html). Reading
  * the revision ARN from the wrong level collapses the startedBy tag to a
  * shared constant across every deploy, so ListTasks can adopt another
@@ -23,19 +38,62 @@ const {
   ECSClient,
   RunTaskCommand,
   DescribeTasksCommand,
-  ListTasksCommand
+  ListTasksCommand,
+  DescribeServiceRevisionsCommand,
+  DescribeTaskDefinitionCommand,
+  ListTagsForResourceCommand
 } = require("@aws-sdk/client-ecs");
 
 const POLL_INTERVAL_MS = 5_000;
 const MAX_POLLS_PER_INVOCATION = 20;
 const HOOK_CALLBACK_DELAY_SECONDS = 30;
 
+/**
+ * How many times one invocation reads a service revision ECS reports
+ * MISSING before failing: a revision the deployment just created may not be
+ * visible to DescribeServiceRevisions at once.
+ */
+const MAX_REVISION_READS = 6;
+
+/**
+ * The tag on the service's task definition that names the migration task
+ * definition. MIGRATION_TASK_DEFINITION_TAG_KEY in @fjall/util/migration,
+ * which inline code cannot import; a test pins the two together.
+ */
+const MIGRATION_TASK_DEFINITION_TAG_KEY = "fjall:migration-task-definition";
+
+/**
+ * The docker label on the service's primary container that names the same
+ * migration task definition as the tag. A revision registered by copying
+ * another, as an engine before 40.0.0 registers one for a restart, a
+ * code-only deploy or a reconcile, keeps the container definitions and drops
+ * the tags, so the label is read when the tag is absent.
+ * MIGRATION_TASK_DEFINITION_LABEL_KEY in @fjall/util/migration.
+ */
+const MIGRATION_TASK_DEFINITION_LABEL_KEY =
+  "io.fjall.migration-task-definition";
+
+/**
+ * The tag on a migration task definition that names, space-separated, the
+ * security groups its task runs in, when they are not the service's.
+ * MIGRATION_SECURITY_GROUPS_TAG_KEY in @fjall/util/migration.
+ */
+const MIGRATION_SECURITY_GROUPS_TAG_KEY = "fjall:migration-security-groups";
+
+const TASK_DEFINITION_ARN =
+  /^arn:[^:]+:ecs:[^:]+:\d{12}:task-definition\/[^:]+:\d+$/;
+const SECURITY_GROUP_ID = /^sg-[0-9a-f]+$/;
+
 let _defaultClient;
 function getDefaultClient() {
   if (!_defaultClient) _defaultClient = new ECSClient({});
   return _defaultClient;
 }
 
+function defaultSleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 function startedByTag(targetServiceRevisionArn) {
   // ECS startedBy is bounded to 36 chars; revision id alone is shorter.
   const suffix =
@@ -65,31 +123,194 @@ function extractExecutionId(event) {
   return topLevel || nested || undefined;
 }
 
-function buildContainerOverrides(
-  name,
-  command,
-  image,
-  entryPoint,
-  environment
-) {
-  const override = { name, command };
-  if (image) override.image = image;
-  if (entryPoint && entryPoint.length > 0) override.entryPoint = entryPoint;
-  if (environment && Object.keys(environment).length > 0) {
-    override.environment = Object.entries(environment).map(([key, value]) => ({
-      name: key,
-      value
-    }));
+function failed(reason) {
+  return { hookStatus: "FAILED", reason };
+}
+
+/**
+ * The cluster, the service's task definition and the network configuration
+ * of the deployment's target revision, or a FAILED result naming why.
+ */
+async function readServiceRevision(client, revisionArn, sleep) {
+  let lastReason = "no failure reported";
+  for (let attempt = 0; attempt < MAX_REVISION_READS; attempt++) {
+    const answer = await client.send(
+      new DescribeServiceRevisionsCommand({
+        serviceRevisionArns: [revisionArn]
+      })
+    );
+    const revision = (answer.serviceRevisions || []).find(
+      (candidate) => candidate.serviceRevisionArn === revisionArn
+    );
+    if (revision !== undefined) {
+      const awsvpcConfiguration =
+        revision.networkConfiguration &&
+        revision.networkConfiguration.awsvpcConfiguration;
+      if (
+        typeof revision.clusterArn !== "string" ||
+        typeof revision.taskDefinition !== "string" ||
+        awsvpcConfiguration === undefined
+      ) {
+        return {
+          failure: failed(
+            `Service revision ${revisionArn} names no cluster, task definition or awsvpc network configuration`
+          )
+        };
+      }
+      return {
+        clusterArn: revision.clusterArn,
+        taskDefinition: revision.taskDefinition,
+        awsvpcConfiguration
+      };
+    }
+    const failure = answer.failures && answer.failures[0];
+    lastReason = failure && failure.reason ? failure.reason : lastReason;
+    if (lastReason !== "MISSING") break;
+    if (attempt < MAX_REVISION_READS - 1) await sleep(POLL_INTERVAL_MS);
   }
-  return [override];
+  return {
+    failure: failed(`DescribeServiceRevisions(${revisionArn}): ${lastReason}`)
+  };
 }
 
-async function findExistingTaskArn(client, clusterArn, startedBy) {
+async function tagValue(client, resourceArn, key) {
+  const answer = await client.send(
+    new ListTagsForResourceCommand({ resourceArn })
+  );
+  const tag = (answer.tags || []).find((candidate) => candidate.key === key);
+  return tag === undefined ? undefined : tag.value;
+}
+
+/** The distinct values the task definition's containers give a docker label. */
+async function labelValues(client, taskDefinitionArn, key) {
+  const answer = await client.send(
+    new DescribeTaskDefinitionCommand({ taskDefinition: taskDefinitionArn })
+  );
+  const containers =
+    (answer.taskDefinition && answer.taskDefinition.containerDefinitions) || [];
+  const values = containers
+    .map((container) => container.dockerLabels && container.dockerLabels[key])
+    .filter((value) => typeof value === "string");
+  return [...new Set(values)];
+}
+
+/**
+ * The migration task definition the service's task definition names, and
+ * which of the two named it: its tag, else its primary container's docker
+ * label; or a FAILED result naming why.
+ */
+async function namedMigration(client, serviceTaskDefinition) {
+  const tagged = await tagValue(
+    client,
+    serviceTaskDefinition,
+    MIGRATION_TASK_DEFINITION_TAG_KEY
+  );
+  const migrationNamedBy = tagged !== undefined ? "tag" : "label";
+  const [source, named] =
+    tagged !== undefined
+      ? [`${MIGRATION_TASK_DEFINITION_TAG_KEY} tag`, [tagged]]
+      : [
+          `${MIGRATION_TASK_DEFINITION_LABEL_KEY} docker label`,
+          await labelValues(
+            client,
+            serviceTaskDefinition,
+            MIGRATION_TASK_DEFINITION_LABEL_KEY
+          )
+        ];
+  if (named.length === 0) {
+    return {
+      failure: failed(
+        `Task definition ${serviceTaskDefinition} carries neither a ${MIGRATION_TASK_DEFINITION_TAG_KEY} tag nor a ${MIGRATION_TASK_DEFINITION_LABEL_KEY} docker label naming its migration task definition`
+      )
+    };
+  }
+  if (named.length > 1) {
+    return {
+      failure: failed(
+        `The containers of ${serviceTaskDefinition} name different migration task definitions in their ${source}s`
+      )
+    };
+  }
+  const [migrationTaskDefinition] = named;
+  if (!TASK_DEFINITION_ARN.test(migrationTaskDefinition)) {
+    return {
+      failure: failed(
+        `The ${source} on ${serviceTaskDefinition} is not a task-definition ARN`
+      )
+    };
+  }
+  return { migrationTaskDefinition, migrationNamedBy };
+}
+
+/**
+ * The migration task definition the service's task definition names, what
+ * named it, and the security groups its task runs in, or a FAILED result
+ * naming why.
+ */
+async function readMigrationPlan(client, serviceTaskDefinition) {
+  const named = await namedMigration(client, serviceTaskDefinition);
+  if (named.failure) return named;
+  const { migrationTaskDefinition } = named;
+  const groups = await tagValue(
+    client,
+    migrationTaskDefinition,
+    MIGRATION_SECURITY_GROUPS_TAG_KEY
+  );
+  if (groups === undefined) return named;
+  const securityGroups = groups.split(" ").filter((id) => id !== "");
+  if (
+    securityGroups.length === 0 ||
+    !securityGroups.every((id) => SECURITY_GROUP_ID.test(id))
+  ) {
+    return {
+      failure: failed(
+        `The ${MIGRATION_SECURITY_GROUPS_TAG_KEY} tag on ${migrationTaskDefinition} names no security group ids`
+      )
+    };
+  }
+  return { ...named, securityGroups };
+}
+
+async function tasksStartedBy(client, clusterArn, startedBy, desiredStatus) {
   const result = await client.send(
-    new ListTasksCommand({ cluster: clusterArn, startedBy })
+    new ListTasksCommand({ cluster: clusterArn, startedBy, desiredStatus })
   );
-  if (!result.taskArns || result.taskArns.length === 0) return undefined;
-  return result.taskArns[0];
+  return result.taskArns || [];
+}
+
+/**
+ * The migration task already started for this revision: a running one, or
+ * else the newest stopped one. ListTasks answers RUNNING tasks unless asked,
+ * and a re-invocation can land after the task stopped; ECS keeps a stopped
+ * task listable for about an hour, longer than any one deployment's hook.
+ */
+async function findExistingTaskArn(client, clusterArn, startedBy) {
+  const running = await tasksStartedBy(
+    client,
+    clusterArn,
+    startedBy,
+    "RUNNING"
+  );
+  if (running.length > 0) return running[0];
+  const stopped = await tasksStartedBy(
+    client,
+    clusterArn,
+    startedBy,
+    "STOPPED"
+  );
+  if (stopped.length <= 1) return stopped[0];
+  const desc = await client.send(
+    new DescribeTasksCommand({ cluster: clusterArn, tasks: stopped })
+  );
+  const newest = (desc.tasks || [])
+    .slice()
+    .sort((a, b) => timeOf(b.createdAt) - timeOf(a.createdAt))[0];
+  return newest && newest.taskArn ? newest.taskArn : stopped[0];
+}
+
+function timeOf(value) {
+  const time = value === undefined ? NaN : new Date(value).getTime();
+  return Number.isFinite(time) ? time : 0;
 }
 
 function describeFailureReason(desc) {
@@ -102,11 +323,10 @@ function describeFailureReason(desc) {
 // ARN RunTask just returned. Until the task has been seen once, a miss is
 // "not visible yet" and the poll continues; once it has been seen, a miss is
 // the task vanishing, which is loud. A task never seen inside one
-// invocation's poll budget is loud too — that is a hundred seconds, not
+// invocation's poll budget is loud too - that is a hundred seconds, not
 // consistency lag.
 async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
-  const sleepFn =
-    sleep || ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const sleepFn = sleep || defaultSleep;
   let seen = false;
   let lastMissReason = "no failure reported";
   for (let i = 0; i < MAX_POLLS_PER_INVOCATION; i++) {
@@ -122,18 +342,16 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
             ? task.containers[0].exitCode
             : undefined;
         if (exitCode === 0) return { hookStatus: "SUCCEEDED" };
-        return {
-          hookStatus: "FAILED",
-          reason: `Task exited ${exitCode}: ${task.stoppedReason || "no reason"}`
-        };
+        return failed(
+          `Task exited ${exitCode}: ${task.stoppedReason || "no reason"}`
+        );
       }
     } else {
       lastMissReason = describeFailureReason(desc);
       if (seen) {
-        return {
-          hookStatus: "FAILED",
-          reason: `DescribeTasks returned no task after it had been seen (${lastMissReason})`
-        };
+        return failed(
+          `DescribeTasks returned no task after it had been seen (${lastMissReason})`
+        );
       }
     }
     if (i < MAX_POLLS_PER_INVOCATION - 1) {
@@ -141,10 +359,9 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
     }
   }
   if (!seen) {
-    return {
-      hookStatus: "FAILED",
-      reason: `DescribeTasks returned no task in ${MAX_POLLS_PER_INVOCATION} polls (${lastMissReason})`
-    };
+    return failed(
+      `DescribeTasks returned no task in ${MAX_POLLS_PER_INVOCATION} polls (${lastMissReason})`
+    );
   }
   return {
     hookStatus: "IN_PROGRESS",
@@ -152,70 +369,90 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
   };
 }
 
+/**
+ * The hook's verdict, and the cluster and migration it ran, for its log. The
+ * log says whether the tag or the label named the migration: a revision
+ * copied without its tags runs the migration its copied label names.
+ */
 async function runHandler(event, deps) {
   const targetServiceRevisionArn = extractTargetServiceRevisionArn(event);
   if (!targetServiceRevisionArn) {
     return {
-      hookStatus: "FAILED",
-      reason:
+      result: failed(
         "Lifecycle event missing executionDetails.targetServiceRevisionArn"
+      )
     };
   }
   const client = (deps && deps.client) || getDefaultClient();
-  const sleep = deps && deps.sleep;
-  const config = JSON.parse(
-    (deps && deps.migrateConfig) || process.env.MIGRATE_CONFIG
+  const sleep = (deps && deps.sleep) || defaultSleep;
+
+  const revision = await readServiceRevision(
+    client,
+    targetServiceRevisionArn,
+    sleep
   );
+  if (revision.failure) return { result: revision.failure };
+  const plan = await readMigrationPlan(client, revision.taskDefinition);
+  if (plan.failure) return { result: plan.failure };
+  const ran = {
+    clusterArn: revision.clusterArn,
+    migrationTaskDefinition: plan.migrationTaskDefinition,
+    migrationNamedBy: plan.migrationNamedBy
+  };
   const startedBy = startedByTag(targetServiceRevisionArn);
 
   const existingTaskArn = await findExistingTaskArn(
     client,
-    config.clusterArn,
+    revision.clusterArn,
     startedBy
   );
   if (existingTaskArn) {
-    return pollTaskUntilStopped(
-      client,
-      config.clusterArn,
-      existingTaskArn,
-      sleep
-    );
+    return {
+      ...ran,
+      result: await pollTaskUntilStopped(
+        client,
+        revision.clusterArn,
+        existingTaskArn,
+        sleep
+      )
+    };
   }
 
-  const result = await client.send(
+  const awsvpcConfiguration =
+    plan.securityGroups === undefined
+      ? revision.awsvpcConfiguration
+      : {
+          ...revision.awsvpcConfiguration,
+          securityGroups: plan.securityGroups
+        };
+  const launched = await client.send(
     new RunTaskCommand({
-      cluster: config.clusterArn,
-      taskDefinition: config.taskDefinitionArn,
+      cluster: revision.clusterArn,
+      taskDefinition: plan.migrationTaskDefinition,
       launchType: "FARGATE",
-      networkConfiguration: {
-        awsvpcConfiguration: config.networkConfiguration
-      },
-      overrides: {
-        containerOverrides: buildContainerOverrides(
-          config.name,
-          config.command,
-          config.hasSeparateMigrationTaskDef ? undefined : config.image,
-          config.hasSeparateMigrationTaskDef ? undefined : config.entryPoint,
-          config.environment
-        )
-      },
+      networkConfiguration: { awsvpcConfiguration },
       startedBy
     })
   );
   const taskArn =
-    result.tasks && result.tasks[0] ? result.tasks[0].taskArn : undefined;
+    launched.tasks && launched.tasks[0] ? launched.tasks[0].taskArn : undefined;
   if (!taskArn) {
-    return {
-      hookStatus: "FAILED",
-      reason: "RunTask did not return a task ARN"
-    };
+    return { ...ran, result: failed("RunTask did not return a task ARN") };
   }
-
-  return pollTaskUntilStopped(client, config.clusterArn, taskArn, sleep);
+  return {
+    ...ran,
+    result: await pollTaskUntilStopped(
+      client,
+      revision.clusterArn,
+      taskArn,
+      sleep
+    )
+  };
 }
 
-exports.handler = async (event) => {
-  // Log invocation context + outcome — ECS hooks only surface "hook execution
+/** The handler, with its dependencies injectable: it never rejects. */
+async function handle(event, deps) {
+  // Log invocation context + outcome - ECS hooks only surface "hook execution
   // failure" to the deployment; without these the Lambda log is silent and
   // the failure cause is unrecoverable.
   console.log(
@@ -227,8 +464,10 @@ exports.handler = async (event) => {
     })
   );
   try {
-    const result = await runHandler(event);
-    console.log(JSON.stringify({ msg: "lifecycle-hook-result", ...result }));
+    const { result, ...ran } = await runHandler(event, deps);
+    console.log(
+      JSON.stringify({ msg: "lifecycle-hook-result", ...ran, ...result })
+    );
     return result;
   } catch (err) {
     const reason = err && err.message ? err.message : String(err);
@@ -236,19 +475,27 @@ exports.handler = async (event) => {
     console.error(
       JSON.stringify({ msg: "lifecycle-hook-crashed", reason, stack })
     );
-    return { hookStatus: "FAILED", reason: `Runner crashed: ${reason}` };
+    return failed(`Runner crashed: ${reason}`);
   }
-};
+}
+
+exports.handler = (event) => handle(event);
 
 exports._internals = {
   startedByTag,
   extractTargetServiceRevisionArn,
   extractExecutionId,
-  buildContainerOverrides,
+  readServiceRevision,
+  readMigrationPlan,
   findExistingTaskArn,
   pollTaskUntilStopped,
   runHandler,
+  handle,
+  MIGRATION_TASK_DEFINITION_TAG_KEY,
+  MIGRATION_TASK_DEFINITION_LABEL_KEY,
+  MIGRATION_SECURITY_GROUPS_TAG_KEY,
   POLL_INTERVAL_MS,
   MAX_POLLS_PER_INVOCATION,
+  MAX_REVISION_READS,
   HOOK_CALLBACK_DELAY_SECONDS
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "39.0.5",
+  "version": "39.0.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -40,7 +40,7 @@
     "clean:node": "rm -rf ./node_modules",
     "build:cert-gen-lambda": "node lib/lambda-assets/cert-generator/src/build.mjs",
     "build": "node ../../scripts/run-build.mjs --purpose=build -- npm run build:steps",
-    "build:steps": "npm run clean && npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
+    "build:steps": "npm run clean && npm run build:cert-gen-lambda && tsc && cp -r lib/layers dist/lib/layers && mkdir -p dist/lib/lambda-assets/cert-generator/asset && cp lib/lambda-assets/cert-generator/asset/index.js dist/lib/lambda-assets/cert-generator/asset/index.js && cp lib/lambda-assets/cert-generator/asset/package.json dist/lib/lambda-assets/cert-generator/asset/package.json && mkdir -p dist/lib/lambda-assets/identity-store-user/asset && cp lib/lambda-assets/identity-store-user/asset/index.js dist/lib/lambda-assets/identity-store-user/asset/index.js && cp lib/lambda-assets/identity-store-user/asset/package.json dist/lib/lambda-assets/identity-store-user/asset/package.json && mkdir -p dist/lib/lambda-assets/static-site-forms/asset && cp lib/lambda-assets/static-site-forms/asset/index.js dist/lib/lambda-assets/static-site-forms/asset/index.js && cp lib/lambda-assets/static-site-forms/asset/package.json dist/lib/lambda-assets/static-site-forms/asset/package.json && cp lib/resources/aws/compute/lifecycleHookLambda.source.cjs dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs && cp lib/resources/aws/compute/ecsRolloutBarrierLambda.source.cjs dist/lib/resources/aws/compute/ecsRolloutBarrierLambda.source.cjs && cp lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs dist/lib/resources/aws/compute/ec2GracefulTerminationLambda.source.cjs && cp lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs dist/lib/resources/aws/compute/persistentDataVolumeLambda.source.cjs && cp lib/patterns/aws/devSubstrate.waker.source.cjs dist/lib/patterns/aws/devSubstrate.waker.source.cjs && node ../../scripts/stamp-build.mjs",
     "prepack": "node ../../scripts/check-dist-freshness.mjs",
     "prepublishOnly": "node ../../scripts/audit-package-tarball.mjs",
     "watch": "tsc -w",
@@ -65,6 +65,7 @@
     "format:check": "prettier --check \"lib/**/*.{ts,tsx,js,jsx,json}\" \"scripts/**/*.mts\" \"deploy-tests/**/*.mts\""
   },
   "devDependencies": {
+    "@aws-sdk/client-ecs": "^3.1098.0",
     "@aws-sdk/client-elastic-load-balancing-v2": "^3.1098.0",
     "@aws-sdk/client-iam": "^3.1098.0",
     "@aws-sdk/client-identitystore": "^3.1098.0",
@@ -80,8 +81,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^39.0.5",
-    "@fjall/util": "^39.0.5",
+    "@fjall/generator": "^39.0.6",
+    "@fjall/util": "^39.0.6",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },