@fjall/components-infrastructure 39.0.8 → 39.0.10

package/dist/lib/patterns/aws/compute.d.ts

@@ -3,10 +3,10 @@ import { type Construct } from "constructs";
 import { type SecretImport } from "../../resources/aws/secrets/index.js";
 import { type ComputeType, type IEcsCompute, type ILambdaCompute, type IEc2Compute, type AnyCompute, isCompute, isEcsCompute, isLambdaCompute, isEc2Compute } from "./interfaces/compute.js";
 import type App from "../../app.js";
-import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
+import { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsTargetGroupHealthCheck, type EcsCapacityProviderConfig, type ContainerDependency, type EcsMigrationsConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig } from "./computeEcs.js";
 import { LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions } from "./computeLambda.js";
 import { Ec2Compute, type Ec2ComputeProps } from "./computeEc2.js";
-export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps };
+export { EcsCompute, type EcsComputeProps, type EcsServiceConfig, type ServiceLogAlarm, type EcsContainerConfig, type EcsScalingConfig, type EcsClusterConfig, type EcsRoutingConfig, type EcsTargetGroupHealthCheck, type EcsCapacityProviderConfig, ECS_CAPACITY_PROVIDER_CONFIG, getEcsCapacityProviderConfig, ScalingType, type EcsCapacityProvider, type Ec2CapacityConfig, type ContainerDependency, type EcsMigrationsConfig, validateEcsProps, buildContainerConfigs, expandMigrationsSugar, type ResolvedScalingConfig, resolveScalingConfig, LambdaCompute, type LambdaComputeProps, type ContainerLambdaProps, type CodeLambdaProps, type FunctionUrlConfig, type ResolvedLambdaDeployment, resolveLambdaDeployment, lambdaImageKey, Architecture, HttpMethod, InvokeMode, type FunctionUrlCorsOptions, Ec2Compute, type Ec2ComputeProps };
 export type { ComputeType } from "./interfaces/compute.js";
 /**
  * Configuration defaults for each compute type.

package/dist/lib/patterns/aws/computeEcs.d.ts

@@ -7,7 +7,7 @@ import { type IEcsCompute } from "./interfaces/compute.js";
 import { type SecretImport } from "../../resources/aws/secrets/index.js";
 import EcsCluster, { type EcsClusterProps, type EcsIngressProfile } from "../../resources/aws/compute/ecs.js";
 export { ScalingType } from "./computeEcsTypes.js";
-export type { EcsCapacityProvider, Ec2CapacityConfig, RemoteConnectionSpec, EcsCapacityProviderConfig, EcsContainerConfig, ContainerDependency, ContainerVolume, EcsScheduledTaskConfig, EcsLifecycleHookMigrationsConfig, EcsPostDeployMigrationsConfig, EcsHookMigrationsConfig, EcsMigrationsConfig, EcsMigrationsMode, EcsCircuitBreakerConfig, EcsScalingConfig, EcsClusterConfig, EcsRoutingConfig, EcsServiceConfig, ServiceLogAlarm, EcsComputeProps } from "./computeEcsTypes.js";
+export type { EcsCapacityProvider, Ec2CapacityConfig, RemoteConnectionSpec, EcsCapacityProviderConfig, EcsContainerConfig, ContainerDependency, ContainerVolume, EcsScheduledTaskConfig, EcsLifecycleHookMigrationsConfig, EcsPostDeployMigrationsConfig, EcsHookMigrationsConfig, EcsMigrationsConfig, EcsMigrationsMode, EcsCircuitBreakerConfig, EcsScalingConfig, EcsClusterConfig, EcsRoutingConfig, EcsTargetGroupHealthCheck, EcsServiceConfig, ServiceLogAlarm, EcsComputeProps } from "./computeEcsTypes.js";
 import { ScalingType, type EcsCapacityProviderConfig, type EcsCapacityProvider, type EcsContainerConfig, type EcsScalingConfig, type EcsServiceConfig, type EcsComputeProps, type QueueScalingConfig } from "./computeEcsTypes.js";
 export declare const ECS_CAPACITY_PROVIDER_CONFIG: Record<EcsCapacityProvider, EcsCapacityProviderConfig>;
 export declare function getEcsCapacityProviderConfig(provider: EcsCapacityProvider): EcsCapacityProviderConfig;

package/dist/lib/patterns/aws/computeEcs.js

@@ -28,8 +28,9 @@ import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab, buildParameterPath } from "@fjall/util";
 import { MIGRATION_SECURITY_GROUPS_TAG_KEY, SCHEMA_GATE_CH_CA_CERT_ENV, SCHEMA_GATE_CH_DATABASE_ENV, SCHEMA_GATE_CH_URL_ENV, SCHEMA_GATE_CONTAINER_NAME, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_ECR_REPO_NAME, SCHEMA_GATE_START_TIMEOUT_SECONDS } from "@fjall/util/migration";
 import { CONSTRUCTS_VERSION } from "../../utils/engineCompat.js";
-import { validateEc2ServiceSizing, validateEc2TaskMemoryFit, validateEcsDomainConfig, validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
+import { clusterHasNoLoadBalancer, validateEc2ServiceSizing, validateEc2TaskMemoryFit, validateEcsDomainConfig, validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
 import { validateSharedEc2CapacityConfig } from "../../resources/aws/compute/ecsCapacityConfig.js";
+import { validateTargetGroupSettings } from "../../resources/aws/compute/ecsTargetGroup.js";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations, normaliseSchemaGate } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -196,6 +197,7 @@ export function validateEcsProps(props) {
                 throw new Error(`Service '${service.name}': circuitBreaker.threshold must be a positive integer (got ${threshold}).`);
             }
         }
+        validateTargetGroupSettings(service, clusterHasNoLoadBalancer(props.cluster));
         if (service.deployment !== undefined) {
             const min = service.deployment.minHealthyPercent;
             const max = service.deployment.maxHealthyPercent;
@@ -1007,6 +1009,12 @@ export class EcsCompute extends Construct {
                 maxCapacity,
                 ...(queueScaling !== undefined && { queueScaling }),
                 routing: service.routing,
+                ...(service.healthCheck !== undefined && {
+                    healthCheck: service.healthCheck
+                }),
+                ...(service.deregistrationDelay !== undefined && {
+                    deregistrationDelay: service.deregistrationDelay
+                }),
                 taskRoleInlinePolicies: service.taskRoleInlinePolicies,
                 taskRoleManagedPolicies: service.taskRoleManagedPolicies,
                 connections: service.connections,

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -7,7 +7,8 @@ import type { ITopic } from "aws-cdk-lib/aws-sns";
 import { type ConnectionSpec } from "./interfaces/connector.js";
 import type { BackupTier } from "../../utils/backupTierMapping.js";
 import { type RemoteConnectionSpec } from "../../resources/aws/compute/ecsRemoteConnections.js";
-import { type EcsRoutingConfig, type EcsContainerDependency } from "../../resources/aws/compute/ecsTypes.js";
+import type { Duration } from "aws-cdk-lib";
+import { type EcsRoutingConfig, type EcsContainerDependency, type EcsTargetGroupHealthCheck } from "../../resources/aws/compute/ecsTypes.js";
 import { ScalingType, type DomainConfig, type EcsCapacityProvider, type Ec2CapacityConfig, type QueueScalingConfig } from "../../resources/aws/compute/ecs.js";
 import type { EcsServiceAlarmThresholds, LogPatternAlarmSpec } from "../../resources/aws/monitoring/index.js";
 import { type SecretImport } from "../../resources/aws/secrets/index.js";
@@ -666,7 +667,7 @@ export interface EcsClusterConfig {
      */
     scheduledTasks?: EcsScheduledTaskConfig[];
 }
-export type { EcsRoutingConfig };
+export type { EcsRoutingConfig, EcsTargetGroupHealthCheck };
 /**
  * Configuration for a service in an ECS cluster.
  * Each service gets its own task definition, scaling config, and target group.
@@ -739,6 +740,40 @@ export interface EcsServiceConfig {
      * ]
      */
     routing?: EcsRoutingConfig | EcsRoutingConfig[];
+    /**
+     * Health check of this service's target group on the cluster's load
+     * balancer, in CDK's `HealthCheck` names. Each key left out takes its launch
+     * type's default: on EC2, `interval` 30 s, `timeout` 15 s,
+     * `healthyThresholdCount` 3 and `unhealthyThresholdCount` 3; on Fargate,
+     * `interval` 120 s and `timeout` 10 s, with both thresholds left to Elastic
+     * Load Balancing (5 and 2). `path` defaults to the routing rule's
+     * `healthCheckPath` or `/`. Refused at synth on a service with no target
+     * group (no container port, or a cluster without a load balancer), outside
+     * Elastic Load Balancing's ranges, with a `timeout` no shorter than the
+     * `interval`, and with an `interval` above 120 seconds: a rollout waits up
+     * to one interval for each new task's first check, and
+     * `fjall deploy --deploy-only`, `fjall rollback` and `fjall rollout` wait a
+     * fixed time sized for no more. Of its keys only `path` is refused beside a
+     * routing `healthCheckPath`, which sets the same value; the others may be
+     * set beside one.
+     *
+     * @example
+     * healthCheck: { path: "/healthz", interval: Duration.seconds(10), timeout: Duration.seconds(5) }
+     */
+    healthCheck?: EcsTargetGroupHealthCheck;
+    /**
+     * How long the target group drains a task it deregisters before ECS stops
+     * it. Default: none set, so Elastic Load Balancing's 300 seconds applies.
+     * ECS sends the stop signal only after the drain (verified 2026-10-15
+     * against the ECS developer guide), so a container's `stopTimeout` starts
+     * once the drain has ended, and the drain should cover the longest request
+     * the service serves. Lower it for a service whose requests are short: a
+     * rollout waits out each old task's drain, and `fjall deploy --deploy-only`,
+     * `fjall rollback` and `fjall rollout` wait a fixed time sized for no more
+     * than 300 seconds. Refused at synth above 300 seconds, on a service with no
+     * target group, and when it is not a whole number of seconds.
+     */
+    deregistrationDelay?: Duration;
     /**
      * CPU units for this service's tasks (256-4096). Fargate only — EC2 task
      * definitions carry no task-level CPU reservation (CPU is bounded by the

package/dist/lib/resources/aws/compute/ecs.js

@@ -13,7 +13,7 @@ import { toPascalCase } from "../../../utils/capitaliseString.js";
 import { createEcsServiceAlarms, createEcsTaskStopWatchdog, createLogPatternAlarms } from "../monitoring/index.js";
 // Extracted modules
 import { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
-import { validateEcsClusterProps } from "./ecsValidation.js";
+import { clusterHasNoLoadBalancer, validateEcsClusterProps } from "./ecsValidation.js";
 import { createExecutionRole, createTaskRole, createTaskDefinition, addContainersToTask, isServiceFargate, isServiceEc2 } from "./ecsTaskDefinition.js";
 import { addLoadBalancer, addLoadBalancerListener, addHostedZone, addDirectAccessOutputs, addRedirectHostRules, registerServiceWithALB } from "./ecsNetworking.js";
 import { createService, addServiceScaling, getOrCreateAsgCapacityProvider } from "./ecsServiceFactory.js";
@@ -110,8 +110,7 @@ export default class EcsCluster extends Construct {
         // Sanitise cluster name for CloudFormation output keys (must be alphanumeric)
         this.outputName = toPascalCase(props.clusterName);
         this.directAccessEnabled = props.cluster?.directAccess === true;
-        this.loadBalancerDisabled =
-            props.cluster?.loadBalancer === false || this.directAccessEnabled;
+        this.loadBalancerDisabled = clusterHasNoLoadBalancer(props.cluster);
         // Tier-owned defaults resolve exactly once, here; every helper reads the
         // resolved value from ctx. An explicit prop is the override.
         const tier = props.appBackupTier;

package/dist/lib/resources/aws/compute/ecsNetworking.js

@@ -1,11 +1,12 @@
 import { ApplicationProtocol, ListenerAction, ListenerCertificate, ListenerCondition } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { Port } from "aws-cdk-lib/aws-ec2";
-import { CfnOutput, Duration, Fn, Stack, Token } from "aws-cdk-lib";
+import { CfnOutput, Fn, Stack, Token } from "aws-cdk-lib";
 import { createHash } from "node:crypto";
 import { Certificate } from "aws-cdk-lib/aws-certificatemanager";
 import { HostedZone as AWSHostedZone } from "aws-cdk-lib/aws-route53";
 import { LoadBalancerTarget } from "aws-cdk-lib/aws-route53-targets";
 import { DomainCertificate } from "../networking/domainCertificate.js";
+import { resolveTargetGroupSettings } from "./ecsTargetGroup.js";
 import { AliasRecord } from "../networking/dnsRecord/aliasRecord.js";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { isManagedDomainBinding, isWithinZone, recordLabelWithin } from "../../../utils/domainTypes.js";
@@ -570,22 +571,7 @@ export function registerServiceWithALB(ctx, listener, serviceName, serviceProps,
             "ports, which can never receive listener traffic.");
     }
     const { routingRules } = servicePlan;
-    const healthCheckPath = routingRules.find((r) => r.healthCheckPath)?.healthCheckPath ?? "/";
-    const healthCheckConfig = isServiceEc2(serviceProps)
-        ? {
-            interval: Duration.seconds(30),
-            healthyThresholdCount: 3,
-            unhealthyThresholdCount: 3,
-            path: healthCheckPath,
-            port: "traffic-port",
-            timeout: Duration.seconds(15)
-        }
-        : {
-            interval: Duration.seconds(120),
-            path: healthCheckPath,
-            port: `${containerPort}`,
-            timeout: Duration.seconds(10)
-        };
+    const { healthCheck: healthCheckConfig, deregistrationDelay } = resolveTargetGroupSettings(serviceProps, isServiceEc2(serviceProps) ? "traffic-port" : `${containerPort}`);
     if (servicePlan.mode === "default") {
         return listener.addTargets(`${serviceName}TargetGroup`, {
             targets: [
@@ -596,7 +582,8 @@ export function registerServiceWithALB(ctx, listener, serviceName, serviceProps,
             ],
             port: containerPort,
             protocol: ApplicationProtocol.HTTP,
-            healthCheck: healthCheckConfig
+            healthCheck: healthCheckConfig,
+            ...(deregistrationDelay !== undefined && { deregistrationDelay })
         });
     }
     else {
@@ -614,6 +601,7 @@ export function registerServiceWithALB(ctx, listener, serviceName, serviceProps,
             port: containerPort,
             protocol: ApplicationProtocol.HTTP,
             healthCheck: healthCheckConfig,
+            ...(deregistrationDelay !== undefined && { deregistrationDelay }),
             conditions: buildRoutingConditions(firstRule),
             priority: firstPriority
         });

package/dist/lib/resources/aws/compute/ecsTargetGroup.d.ts

@@ -0,0 +1,55 @@
+import { Duration } from "aws-cdk-lib";
+import type { HealthCheck } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import type { EcsCapacityProvider, EcsRoutingConfig, EcsTargetGroupHealthCheck } from "./ecsTypes.js";
+/**
+ * The fields of a service the target-group settings are judged and resolved
+ * from. Both layers' service shapes satisfy it, so the patterns layer's
+ * `EcsServiceConfig` and the resources layer's `EcsServiceProps` go through
+ * the same check.
+ */
+interface TargetGroupSettingsSource {
+    readonly name: string;
+    readonly capacityProvider: EcsCapacityProvider;
+    readonly containers?: ReadonlyArray<{
+        readonly port?: number;
+    }>;
+    readonly routing?: EcsRoutingConfig | EcsRoutingConfig[];
+    readonly healthCheck?: EcsTargetGroupHealthCheck;
+    readonly deregistrationDelay?: Duration;
+}
+/**
+ * Refuses a service's target-group settings that would be silently ignored
+ * or that Elastic Load Balancing would refuse mid-deploy. Pure: the
+ * resources layer's `validateEcsClusterProps` calls it for every service, and
+ * the patterns layer's `validateEcsProps` calls it again.
+ *
+ * - A service with no container port, or on a cluster with no load balancer,
+ *   has no target group, so either setting is refused.
+ * - `healthCheck.path` beside a routing rule's `healthCheckPath` is two
+ *   sources for one value, so the pair is refused.
+ * - A timeout no shorter than the interval is refused, each key the service
+ *   leaves out taking its launch type's default.
+ * - An `interval` or a drain longer than `ECS_TASK_REPLACEMENT_LIMITS` allows
+ *   is refused, though Elastic Load Balancing would take it: a rollout waits
+ *   for each new task's first check and each old task's drain, and the
+ *   engine's own rollout waits are sized for those limits.
+ *
+ * No refusal judges the drain against a container's `stopTimeout`. ECS
+ * deregisters a task and waits out the drain before it sends the stop
+ * signal, and only then starts the `stopTimeout` wait for SIGKILL (verified
+ * 2026-10-15 against the ECS developer guide), so neither phase has to cover
+ * the other, and a drain shorter than `stopTimeout` is valid.
+ */
+export declare function validateTargetGroupSettings(source: TargetGroupSettingsSource, loadBalancerDisabled: boolean): void;
+/**
+ * The health check and drain a service's target group is built with: each
+ * key the service sets, and its launch type's default for every other. A
+ * threshold with no default is left out, as is the drain when the service
+ * sets none, so Elastic Load Balancing's own value applies. `port` is the
+ * launch type's (the container port on Fargate, `traffic-port` on EC2).
+ */
+export declare function resolveTargetGroupSettings(source: TargetGroupSettingsSource, port: string): {
+    healthCheck: HealthCheck;
+    deregistrationDelay: Duration | undefined;
+};
+export {};

package/dist/lib/resources/aws/compute/ecsTargetGroup.js

@@ -0,0 +1,161 @@
+import { Duration } from "aws-cdk-lib";
+import { ECS_TASK_REPLACEMENT_LIMITS } from "@fjall/util";
+const EC2_HEALTH_CHECK_DEFAULTS = {
+    launchType: "EC2",
+    intervalSeconds: 30,
+    timeoutSeconds: 15,
+    healthyThresholdCount: 3,
+    unhealthyThresholdCount: 3
+};
+const FARGATE_HEALTH_CHECK_DEFAULTS = {
+    launchType: "Fargate",
+    intervalSeconds: 120,
+    timeoutSeconds: 10
+};
+const HEALTH_CHECK_DEFAULTS = {
+    EC2: EC2_HEALTH_CHECK_DEFAULTS,
+    FARGATE: FARGATE_HEALTH_CHECK_DEFAULTS,
+    FARGATE_SPOT: FARGATE_HEALTH_CHECK_DEFAULTS
+};
+// Elastic Load Balancing's bounds for an application target group
+// (CreateTargetGroup / ModifyTargetGroupAttributes), except the interval's
+// and the drain's maxima: Elastic Load Balancing allows 300 s and 3600 s, and
+// these stop at what Fjall's rollout waits are sized for.
+const HEALTH_CHECK_INTERVAL_RANGE = {
+    min: 5,
+    max: ECS_TASK_REPLACEMENT_LIMITS.healthCheckIntervalSeconds
+};
+const HEALTH_CHECK_TIMEOUT_RANGE = { min: 2, max: 120 };
+const THRESHOLD_COUNT_RANGE = { min: 2, max: 10 };
+const DEREGISTRATION_DELAY_RANGE = {
+    min: 0,
+    max: ECS_TASK_REPLACEMENT_LIMITS.deregistrationDelaySeconds
+};
+const HEALTH_CHECK_PATH_MAX_LENGTH = 1024;
+const ROLLOUT_WAIT_REASON = {
+    interval: " A rollout waits up to one interval for each new task's first check, and fjall deploy --deploy-only, " +
+        "fjall rollback and fjall rollout wait a fixed time sized for no more.",
+    deregistrationDelay: " A rollout waits out each old task's drain, and fjall deploy --deploy-only, fjall rollback and " +
+        "fjall rollout wait a fixed time sized for no more."
+};
+function routingHealthCheckPath(routing) {
+    const rules = Array.isArray(routing) ? routing : routing ? [routing] : [];
+    return rules.find((r) => r.healthCheckPath)?.healthCheckPath;
+}
+function wholeSeconds(serviceName, key, value) {
+    const seconds = value.toSeconds({ integral: false });
+    if (!Number.isInteger(seconds)) {
+        throw new Error(`Service '${serviceName}': ${key} must be a whole number of seconds.`);
+    }
+    return seconds;
+}
+function requireWithin(serviceName, key, value, range, unit, reason = "") {
+    if (value < range.min || value > range.max) {
+        throw new Error(`Service '${serviceName}': ${key} must be between ${range.min} and ${range.max}${unit} (got ${value}).${reason}`);
+    }
+}
+/**
+ * Refuses a service's target-group settings that would be silently ignored
+ * or that Elastic Load Balancing would refuse mid-deploy. Pure: the
+ * resources layer's `validateEcsClusterProps` calls it for every service, and
+ * the patterns layer's `validateEcsProps` calls it again.
+ *
+ * - A service with no container port, or on a cluster with no load balancer,
+ *   has no target group, so either setting is refused.
+ * - `healthCheck.path` beside a routing rule's `healthCheckPath` is two
+ *   sources for one value, so the pair is refused.
+ * - A timeout no shorter than the interval is refused, each key the service
+ *   leaves out taking its launch type's default.
+ * - An `interval` or a drain longer than `ECS_TASK_REPLACEMENT_LIMITS` allows
+ *   is refused, though Elastic Load Balancing would take it: a rollout waits
+ *   for each new task's first check and each old task's drain, and the
+ *   engine's own rollout waits are sized for those limits.
+ *
+ * No refusal judges the drain against a container's `stopTimeout`. ECS
+ * deregisters a task and waits out the drain before it sends the stop
+ * signal, and only then starts the `stopTimeout` wait for SIGKILL (verified
+ * 2026-10-15 against the ECS developer guide), so neither phase has to cover
+ * the other, and a drain shorter than `stopTimeout` is valid.
+ */
+export function validateTargetGroupSettings(source, loadBalancerDisabled) {
+    const { name, healthCheck, deregistrationDelay } = source;
+    if (healthCheck === undefined && deregistrationDelay === undefined)
+        return;
+    const setting = healthCheck !== undefined ? "healthCheck" : "deregistrationDelay";
+    if (loadBalancerDisabled) {
+        throw new Error(`Service '${name}': ${setting} configures the service's target group on the cluster's load balancer, ` +
+            "which loadBalancer: false and directAccess: true both leave out. Drop it, or give the cluster a load balancer.");
+    }
+    if (!source.containers?.some((c) => c.port !== undefined)) {
+        throw new Error(`Service '${name}': ${setting} configures the service's target group, but no container declares a port, ` +
+            "so the service is never registered with the load balancer. Drop it, or give the primary container a port.");
+    }
+    if (healthCheck !== undefined) {
+        const defaults = HEALTH_CHECK_DEFAULTS[source.capacityProvider];
+        const interval = healthCheck.interval !== undefined
+            ? wholeSeconds(name, "healthCheck.interval", healthCheck.interval)
+            : defaults.intervalSeconds;
+        const timeout = healthCheck.timeout !== undefined
+            ? wholeSeconds(name, "healthCheck.timeout", healthCheck.timeout)
+            : defaults.timeoutSeconds;
+        requireWithin(name, "healthCheck.interval", interval, HEALTH_CHECK_INTERVAL_RANGE, " seconds", ROLLOUT_WAIT_REASON.interval);
+        requireWithin(name, "healthCheck.timeout", timeout, HEALTH_CHECK_TIMEOUT_RANGE, " seconds");
+        if (timeout >= interval) {
+            throw new Error(`Service '${name}': healthCheck.timeout (${timeout} seconds) must be shorter than healthCheck.interval ` +
+                `(${interval} seconds); a key left out takes the ${defaults.launchType} default (interval ` +
+                `${defaults.intervalSeconds}, timeout ${defaults.timeoutSeconds}).`);
+        }
+        for (const key of [
+            "healthyThresholdCount",
+            "unhealthyThresholdCount"
+        ]) {
+            const count = healthCheck[key];
+            if (count === undefined)
+                continue;
+            if (!Number.isInteger(count)) {
+                throw new Error(`Service '${name}': healthCheck.${key} must be a whole number (got ${count}).`);
+            }
+            requireWithin(name, `healthCheck.${key}`, count, THRESHOLD_COUNT_RANGE, "");
+        }
+        if (healthCheck.path !== undefined) {
+            if (!healthCheck.path.startsWith("/") ||
+                healthCheck.path.length > HEALTH_CHECK_PATH_MAX_LENGTH) {
+                throw new Error(`Service '${name}': healthCheck.path must start with '/' and be at most ${HEALTH_CHECK_PATH_MAX_LENGTH} characters.`);
+            }
+            if (routingHealthCheckPath(source.routing) !== undefined) {
+                throw new Error(`Service '${name}': healthCheck.path and routing healthCheckPath both set the target group's health-check path. ` +
+                    "Keep one.");
+            }
+        }
+    }
+    if (deregistrationDelay !== undefined) {
+        const delay = wholeSeconds(name, "deregistrationDelay", deregistrationDelay);
+        requireWithin(name, "deregistrationDelay", delay, DEREGISTRATION_DELAY_RANGE, " seconds", ROLLOUT_WAIT_REASON.deregistrationDelay);
+    }
+}
+/**
+ * The health check and drain a service's target group is built with: each
+ * key the service sets, and its launch type's default for every other. A
+ * threshold with no default is left out, as is the drain when the service
+ * sets none, so Elastic Load Balancing's own value applies. `port` is the
+ * launch type's (the container port on Fargate, `traffic-port` on EC2).
+ */
+export function resolveTargetGroupSettings(source, port) {
+    const configured = source.healthCheck;
+    const defaults = HEALTH_CHECK_DEFAULTS[source.capacityProvider];
+    const healthyThresholdCount = configured?.healthyThresholdCount ?? defaults.healthyThresholdCount;
+    const unhealthyThresholdCount = configured?.unhealthyThresholdCount ?? defaults.unhealthyThresholdCount;
+    return {
+        healthCheck: {
+            interval: configured?.interval ?? Duration.seconds(defaults.intervalSeconds),
+            ...(healthyThresholdCount !== undefined && { healthyThresholdCount }),
+            ...(unhealthyThresholdCount !== undefined && {
+                unhealthyThresholdCount
+            }),
+            path: configured?.path ?? routingHealthCheckPath(source.routing) ?? "/",
+            port,
+            timeout: configured?.timeout ?? Duration.seconds(defaults.timeoutSeconds)
+        },
+        deregistrationDelay: source.deregistrationDelay
+    };
+}

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -11,7 +11,7 @@ import { type Duration } from "aws-cdk-lib";
 import { type GeoLocation } from "aws-cdk-lib/aws-route53";
 import { type Repository } from "aws-cdk-lib/aws-ecr";
 import { type FargateService, type Ec2Service, type FargateTaskDefinition, type Ec2TaskDefinition } from "aws-cdk-lib/aws-ecs";
-import { type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import { type HealthCheck, type IApplicationTargetGroup } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { type Role } from "aws-cdk-lib/aws-iam";
 import { type HostedZone as FjallHostedZone } from "../networking/hostedZone.js";
 import { type Certificate } from "aws-cdk-lib/aws-certificatemanager";
@@ -502,6 +502,13 @@ export interface EcsRoutingConfig {
     /** Health check path for this service's target group. Default: "/" */
     healthCheckPath?: string;
 }
+/**
+ * The settings a service may tune on its target group's health check: CDK's
+ * `HealthCheck`, narrowed to the five keys Fjall exposes. The port and
+ * protocol stay Fjall's (the container port on Fargate, the traffic port on
+ * EC2; HTTP), so they are not offered.
+ */
+export type EcsTargetGroupHealthCheck = Pick<HealthCheck, "interval" | "timeout" | "healthyThresholdCount" | "unhealthyThresholdCount" | "path">;
 /**
  * Configuration for a service in an ECS cluster.
  * Each service gets its own task definition, scaling, and target group.
@@ -568,6 +575,37 @@ export interface EcsServiceProps {
      * Can be a single rule or an array of rules pointing to the same target group.
      */
     routing?: EcsRoutingConfig | EcsRoutingConfig[];
+    /**
+     * Health check of this service's target group on the cluster's load
+     * balancer, in CDK's `HealthCheck` names. Each key left out takes its launch
+     * type's default: on EC2, `interval` 30 s, `timeout` 15 s,
+     * `healthyThresholdCount` 3 and `unhealthyThresholdCount` 3; on Fargate,
+     * `interval` 120 s and `timeout` 10 s, with both thresholds left to Elastic
+     * Load Balancing (5 and 2). `path` defaults to the routing rule's
+     * `healthCheckPath` or `/`. Refused at synth on a service with no target
+     * group (no container port, or a cluster without a load balancer), outside
+     * Elastic Load Balancing's ranges, with a `timeout` no shorter than the
+     * `interval`, and with an `interval` above 120 seconds: a rollout waits up
+     * to one interval for each new task's first check, and
+     * `fjall deploy --deploy-only`, `fjall rollback` and `fjall rollout` wait a
+     * fixed time sized for no more. Of its keys only `path` is refused beside a
+     * routing `healthCheckPath`, which sets the same value; the others may be
+     * set beside one.
+     */
+    healthCheck?: EcsTargetGroupHealthCheck;
+    /**
+     * How long the target group drains a task it deregisters before ECS stops
+     * it. Default: none set, so Elastic Load Balancing's 300 seconds applies.
+     * ECS sends the stop signal only after the drain (verified 2026-10-15
+     * against the ECS developer guide), so a container's `stopTimeout` starts
+     * once the drain has ended, and the drain should cover the longest request
+     * the service serves. Lower it for a service whose requests are short: a
+     * rollout waits out each old task's drain, and `fjall deploy --deploy-only`,
+     * `fjall rollback` and `fjall rollout` wait a fixed time sized for no more
+     * than 300 seconds. Refused at synth above 300 seconds, on a service with no
+     * target group, and when it is not a whole number of seconds.
+     */
+    deregistrationDelay?: Duration;
     /**
      * Additional inline policies for this service's task role.
      * Added on top of the default ECS Exec permissions.

package/dist/lib/resources/aws/compute/ecsValidation.d.ts

@@ -1,5 +1,11 @@
 import type { IConstruct } from "constructs";
-import type { DomainConfig, EcsCapacityProvider, EcsClusterProps } from "./ecsTypes.js";
+import type { DomainConfig, EcsCapacityProvider, EcsClusterClusterConfig, EcsClusterProps } from "./ecsTypes.js";
+/**
+ * Whether the cluster leaves its shared load balancer out. `EcsCluster`
+ * builds none on this condition, and both validation layers read it, so the
+ * construct and its validation cannot answer it differently.
+ */
+export declare function clusterHasNoLoadBalancer(cluster: Pick<EcsClusterClusterConfig, "loadBalancer" | "directAccess"> | undefined): boolean;
 /**
  * Validates ECS cluster props before construction.
  * Pure function — does not depend on class state.

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -2,10 +2,19 @@ import { Annotations } from "aws-cdk-lib";
 import { NetworkMode } from "aws-cdk-lib/aws-ecs";
 import { evaluateBakeGuard } from "@fjall/util/docker";
 import { SCHEMA_GATE_CONTAINER_NAME } from "@fjall/util/migration";
-import { toKebab, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SECRET_NAME_PATTERN, SECRET_NAME_ERROR } from "@fjall/util";
+import { toKebab, ECS_TASK_REPLACEMENT_LIMITS, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SECRET_NAME_PATTERN, SECRET_NAME_ERROR } from "@fjall/util";
 import { ScalingType } from "./ecsTypes.js";
 import { DEFAULT_EC2_CONTAINER_MEMORY_MIB, DEFAULT_ECS_EC2_INSTANCE_TYPE, SCHEMA_GATE_CONTAINER_MEMORY_MIB, estimatedEc2MemoryReserveMiB, nominalEc2InstanceMemoryMiB, resolveEc2ContainerMemoryMiB } from "./ecsConstants.js";
 import { validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
+import { validateTargetGroupSettings } from "./ecsTargetGroup.js";
+/**
+ * Whether the cluster leaves its shared load balancer out. `EcsCluster`
+ * builds none on this condition, and both validation layers read it, so the
+ * construct and its validation cannot answer it differently.
+ */
+export function clusterHasNoLoadBalancer(cluster) {
+    return cluster?.loadBalancer === false || cluster?.directAccess === true;
+}
 /**
  * Validates ECS cluster props before construction.
  * Pure function — does not depend on class state.
@@ -50,8 +59,7 @@ import { validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
  */
 export function validateEcsClusterProps(props, annotationsScope) {
     validateEcsDomainConfig(props.cluster?.domainConfig, props.clusterName);
-    const loadBalancerDisabled = props.cluster?.loadBalancer === false ||
-        props.cluster?.directAccess === true;
+    const loadBalancerDisabled = clusterHasNoLoadBalancer(props.cluster);
     if (loadBalancerDisabled) {
         const domainConfig = props.cluster?.domainConfig;
         const listenerFeature = (domainConfig?.redirectHosts?.length ?? 0) > 0
@@ -119,11 +127,12 @@ export function validateEcsClusterProps(props, annotationsScope) {
         }
         for (const container of service.containers) {
             if (container.stopTimeout !== undefined) {
+                const { stopTimeoutSeconds } = ECS_TASK_REPLACEMENT_LIMITS;
                 if (!Number.isInteger(container.stopTimeout) ||
                     container.stopTimeout < 1 ||
-                    container.stopTimeout > 120) {
+                    container.stopTimeout > stopTimeoutSeconds) {
                     throw new Error(`Service '${service.name}', container '${container.name ?? "(default)"}': ` +
-                        `stopTimeout must be an integer between 1 and 120 seconds (got ${container.stopTimeout}).`);
+                        `stopTimeout must be an integer between 1 and ${stopTimeoutSeconds} seconds (got ${container.stopTimeout}).`);
                 }
             }
             // A host-bind volume silently no-ops on Fargate (no host filesystem),
@@ -175,6 +184,7 @@ export function validateEcsClusterProps(props, annotationsScope) {
                     "(no capacity to drain or expand — deploys would never roll forward).");
             }
         }
+        validateTargetGroupSettings(service, loadBalancerDisabled);
         if (service.cloudMapDnsRecordType !== undefined &&
             service.cloudMapService === undefined) {
             throw new Error(`Service '${service.name}': cloudMapDnsRecordType is set but cloudMapService is not. ` +

package/dist/lib/resources/aws/compute/lifecycleHookLambda.source.cjs

@@ -16,10 +16,15 @@
  * own update and the service's are ordered. The Lambda changes only when its
  * code does.
  *
- * Re-invocation safety: ECS hook responses do NOT carry state between
- * IN_PROGRESS invocations. On every invocation we reconstruct the
- * deterministic startedBy tag from the event's
- * executionDetails.targetServiceRevisionArn and use ListTasks to find the
+ * Re-invocation safety: every IN_PROGRESS carries the migration task's ARN in
+ * hookDetails, which ECS passes back on the hook's next invocation within the
+ * same deployment (AWS "Lambda hooks for Amazon ECS service deployments",
+ * developerguide/lambda-lifecycle-hooks.html, read 1 November 2026). An
+ * invocation that carries it polls that task, adopting it only when it was
+ * started under this revision's startedBy tag from this revision's migration
+ * task definition, and never lists or runs one. An invocation that carries
+ * none reconstructs the deterministic startedBy tag from the event's
+ * executionDetails.targetServiceRevisionArn and uses ListTasks to find the
  * migration task already started for it, running or stopped. RunTask fires
  * only when there is none.
  *
@@ -83,6 +88,10 @@ const MIGRATION_SECURITY_GROUPS_TAG_KEY = "fjall:migration-security-groups";
 const TASK_DEFINITION_ARN =
   /^arn:[^:]+:ecs:[^:]+:\d{12}:task-definition\/[^:]+:\d+$/;
 const SECURITY_GROUP_ID = /^sg-[0-9a-f]+$/;
+const TASK_ARN = /^arn:[^:]+:ecs:[^:]+:\d{12}:task\/[^/\s]+(\/[^/\s]+)?$/;
+
+/** The hookDetails key that carries the migration task between invocations. */
+const HOOK_DETAILS_TASK_KEY = "fjallMigrationTaskArn";
 
 let _defaultClient;
 function getDefaultClient() {
@@ -280,9 +289,11 @@ async function tasksStartedBy(client, clusterArn, startedBy, desiredStatus) {
 
 /**
  * The migration task already started for this revision: a running one, or
- * else the newest stopped one. ListTasks answers RUNNING tasks unless asked,
- * and a re-invocation can land after the task stopped; ECS keeps a stopped
- * task listable for about an hour, longer than any one deployment's hook.
+ * else the newest stopped one. ListTasks answers RUNNING tasks unless asked.
+ * Its reference says startedBy must be the only filter and that a recently
+ * stopped task only might appear (@aws-sdk/client-ecs, read 1 November 2026),
+ * so a miss here can run a stopped migration again. A reinvocation avoids this
+ * lookup by carrying its task in hookDetails.
  */
 async function findExistingTaskArn(client, clusterArn, startedBy) {
   const running = await tasksStartedBy(
@@ -324,10 +335,18 @@ function describeFailureReason(desc) {
 // "not visible yet" and the poll continues; once it has been seen, a miss is
 // the task vanishing, which is loud. A task never seen inside one
 // invocation's poll budget is loud too - that is a hundred seconds, not
-// consistency lag.
-async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
+// consistency lag. A task carried in hookDetails was seen by an earlier
+// invocation, and `adopt` refuses one that is not this revision's migration.
+async function pollTaskUntilStopped(
+  client,
+  clusterArn,
+  taskArn,
+  sleep,
+  options
+) {
   const sleepFn = sleep || defaultSleep;
-  let seen = false;
+  const adopt = options && options.adopt;
+  let seen = Boolean(options && options.seen);
   let lastMissReason = "no failure reported";
   for (let i = 0; i < MAX_POLLS_PER_INVOCATION; i++) {
     const desc = await client.send(
@@ -336,6 +355,8 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
     const task = desc.tasks && desc.tasks[0];
     if (task) {
       seen = true;
+      const refusal = adopt === undefined ? undefined : adopt(task);
+      if (refusal !== undefined) return refusal;
       if (task.lastStatus === "STOPPED") {
         const exitCode =
           task.containers && task.containers[0]
@@ -365,10 +386,37 @@ async function pollTaskUntilStopped(client, clusterArn, taskArn, sleep) {
   }
   return {
     hookStatus: "IN_PROGRESS",
-    callBackDelay: HOOK_CALLBACK_DELAY_SECONDS
+    callBackDelay: HOOK_CALLBACK_DELAY_SECONDS,
+    hookDetails: { [HOOK_DETAILS_TASK_KEY]: taskArn }
   };
 }
 
+/**
+ * The migration task an earlier invocation carried in the event's
+ * hookDetails: `{ taskArn }`, `{}` when it carried none, or a FAILED result
+ * that names the key and never the value, which the service's own hook
+ * configuration could have set.
+ */
+function carriedTask(event) {
+  const details = event && event.hookDetails;
+  if (
+    details === null ||
+    typeof details !== "object" ||
+    !Object.prototype.hasOwnProperty.call(details, HOOK_DETAILS_TASK_KEY)
+  ) {
+    return {};
+  }
+  const taskArn = details[HOOK_DETAILS_TASK_KEY];
+  if (typeof taskArn !== "string" || !TASK_ARN.test(taskArn)) {
+    return {
+      failure: failed(
+        `The ${HOOK_DETAILS_TASK_KEY} in the event's hookDetails is not a task ARN`
+      )
+    };
+  }
+  return { taskArn };
+}
+
 /**
  * The hook's verdict, and the cluster and migration it ran, for its log. The
  * log says whether the tag or the label named the migration: a revision
@@ -401,6 +449,30 @@ async function runHandler(event, deps) {
   };
   const startedBy = startedByTag(targetServiceRevisionArn);
 
+  const carried = carriedTask(event);
+  if (carried.failure) return { ...ran, result: carried.failure };
+  if (carried.taskArn !== undefined) {
+    return {
+      ...ran,
+      result: await pollTaskUntilStopped(
+        client,
+        revision.clusterArn,
+        carried.taskArn,
+        sleep,
+        {
+          seen: true,
+          adopt: (task) =>
+            task.startedBy === startedBy &&
+            task.taskDefinitionArn === plan.migrationTaskDefinition
+              ? undefined
+              : failed(
+                  `The task the event's hookDetails names in ${HOOK_DETAILS_TASK_KEY} was not started for this revision's migration`
+                )
+        }
+      )
+    };
+  }
+
   const existingTaskArn = await findExistingTaskArn(
     client,
     revision.clusterArn,
@@ -494,6 +566,7 @@ exports._internals = {
   MIGRATION_TASK_DEFINITION_TAG_KEY,
   MIGRATION_TASK_DEFINITION_LABEL_KEY,
   MIGRATION_SECURITY_GROUPS_TAG_KEY,
+  HOOK_DETAILS_TASK_KEY,
   POLL_INTERVAL_MS,
   MAX_POLLS_PER_INVOCATION,
   MAX_REVISION_READS,

package/dist/lib/resources/aws/database/rdsDefaults.d.ts

@@ -14,7 +14,7 @@ export declare const RDS_DEFAULTS: Readonly<{
  * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
  * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
  * is the only mode under which min-0 actually saves (a live pooled connection
- * pins the cluster above 0 ACU). Engine 16.10 satisfies the auto-pause-capable
+ * pins the cluster above 0 ACU). Engine 16.15 satisfies the auto-pause-capable
  * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`). AWS removes old minors from
  * the creatable list over time (16.6 rejected with "Cannot find version" by
  * 2026-07) — pin a mid-window minor, not the oldest available, and expect this
@@ -25,7 +25,7 @@ export declare const DEV_AURORA_DEFAULTS: Readonly<{
     readonly SERVERLESS_V2_MAX_CAPACITY: 4;
     readonly AUTO_PAUSE_SECONDS: 1200;
     readonly ENABLE_DATA_API: true;
-    readonly ENGINE_VERSION: "16.10";
+    readonly ENGINE_VERSION: "16.15";
 }>;
 /**
  * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`

package/dist/lib/resources/aws/database/rdsDefaults.js

@@ -14,7 +14,7 @@ export const RDS_DEFAULTS = Object.freeze({
  * (fast dev-envs Phase 3). `min 0` ACU scales the shared cluster to zero when
  * idle; `enableDataApi` lets slot DDL run over HTTPS with no VPC connection, and
  * is the only mode under which min-0 actually saves (a live pooled connection
- * pins the cluster above 0 ACU). Engine 16.10 satisfies the auto-pause-capable
+ * pins the cluster above 0 ACU). Engine 16.15 satisfies the auto-pause-capable
  * floor (see `MIN_AUTO_PAUSE_POSTGRES_VERSION`). AWS removes old minors from
  * the creatable list over time (16.6 rejected with "Cannot find version" by
  * 2026-07) — pin a mid-window minor, not the oldest available, and expect this
@@ -25,7 +25,7 @@ export const DEV_AURORA_DEFAULTS = Object.freeze({
     SERVERLESS_V2_MAX_CAPACITY: 4,
     AUTO_PAUSE_SECONDS: 1200,
     ENABLE_DATA_API: true,
-    ENGINE_VERSION: "16.10"
+    ENGINE_VERSION: "16.15"
 });
 /**
  * Bounds AWS enforces on `ServerlessV2ScalingConfiguration.SecondsUntilAutoPause`

package/dist/lib/utils/getConfig.d.ts

@@ -11,5 +11,10 @@ export interface Config {
     allRegions: string[];
     disasterRecoveryRegion?: string;
 }
+/**
+ * Forget which warnings getConfig has printed, so the next call prints them
+ * again. For testing only.
+ */
+export declare function _resetConfigWarnings(): void;
 export declare function getConfig(accountName?: string): Config;
 export default getConfig;

package/dist/lib/utils/getConfig.js

@@ -3,6 +3,25 @@ import { CDK_CONTEXT_KEYS } from "./cdkContext.js";
 import { parseOrgConfig, resolveSynthEnvironment } from "./orgConfigParser.js";
 import { findAccountNameCollision } from "./capitaliseString.js";
 import { FjallLogger } from "./validationLogger.js";
+/**
+ * The warnings getConfig has printed in this process. Each describes the
+ * process, not the call, and a synth calls getConfig several times, so each
+ * prints once, as `getEnvironment` warns once through its cache.
+ */
+const printedWarnings = new Set();
+function warnOncePerProcess(message) {
+    if (printedWarnings.has(message))
+        return;
+    printedWarnings.add(message);
+    FjallLogger.warn(message);
+}
+/**
+ * Forget which warnings getConfig has printed, so the next call prints them
+ * again. For testing only.
+ */
+export function _resetConfigWarnings() {
+    printedWarnings.clear();
+}
 export function getConfig(accountName) {
     const app = App.getInstance();
     const config = {
@@ -13,11 +32,11 @@ export function getConfig(accountName) {
         allRegions: []
     };
     if (!process.env.AWS_REGION)
-        FjallLogger.warn("AWS_REGION is not set, defaulting to us-east-1");
+        warnOncePerProcess("AWS_REGION is not set, defaulting to us-east-1");
     // Primary: read org config from CDK context (injected by CLI/worker)
     const orgConfigRaw = app.node.tryGetContext(CDK_CONTEXT_KEYS.ORG_CONFIG);
     if (typeof orgConfigRaw !== "string") {
-        FjallLogger.warn("No orgConfig context provided — org-level config (accounts, regions) will be empty");
+        warnOncePerProcess("No orgConfig context provided — org-level config (accounts, regions) will be empty");
     }
     const orgConfig = parseOrgConfig(typeof orgConfigRaw === "string" ? orgConfigRaw : undefined);
     const providerAccounts = orgConfig.providerAccounts;

package/dist/lib/utils/validationLogger.js

@@ -5,7 +5,7 @@
  */
 import { appendFileSync, existsSync, mkdirSync } from "fs";
 import { join } from "path";
-import { fjallLogDir } from "@fjall/util";
+import { FJALL_NOTE_PREFIX, FJALL_WARNING_PREFIX, fjallLogDir } from "@fjall/util";
 import { FileRotator, resolveLogRotationBudget } from "@fjall/util/logRotation";
 const LOG_FILENAME = "infrastructure.jsonl";
 /**
@@ -46,14 +46,14 @@ export const FjallLogger = {
      * Log a warning message with Fjall prefix.
      */
     warn: (message) => {
-        console.warn(`[Fjall] Warning: ${message}`);
+        console.warn(`${FJALL_WARNING_PREFIX}${message}`);
         writeToLog("warn", message);
     },
     /**
      * Log an info message with Fjall prefix.
      */
     info: (message) => {
-        console.info(`[Fjall] Note: ${message}`);
+        console.info(`${FJALL_NOTE_PREFIX}${message}`);
         writeToLog("info", message);
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "39.0.8",
+  "version": "39.0.10",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -81,8 +81,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^39.0.8",
-    "@fjall/util": "^39.0.8",
+    "@fjall/generator": "^39.0.10",
+    "@fjall/util": "^39.0.10",
     "constructs": "^10.7.2",
     "zod": "^4.4.3"
   },