@fjall/components-infrastructure 4.4.0 → 6.0.0

package/dist/lib/config/aws/ebsDefaultEncryption.js

@@ -11,7 +11,7 @@ export class EbsDefaultEncryption extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "EbsDefaultEncryption", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables EBS default encryption at account level",
             inlinePolicy: [

package/dist/lib/config/aws/inspectorEnablement.js

@@ -12,7 +12,7 @@ export class InspectorEnablement extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "InspectorEnable", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables/disables Inspector v2 for the account",
             inlinePolicy: [

package/dist/lib/config/aws/oidcConnector.d.ts

@@ -24,12 +24,12 @@ export interface OidcConnectorProps {
      * Account TIER of the connected account (organisation | platform | account) —
      * the structural TIER axis, from the account stack's polymorphic
      * `deployRoleAccountTier()`; NEVER the wire `environment` / stage axis (that is
-     * `accountStage`). Drives the §4.4a deploy-trust governance expand: a
-     * governance tier (organisation/platform) plus the synth account id widens the
-     * `FjallDeploy` machine subject to ALSO accept the account-scoped literal
-     * `org:{orgId}:acct:{awsAccountId}` (StringEquals array = OR of exact
-     * literals), so per-account deploy issuance can later flip. App-tier
-     * ("account") or absent ⇒ generic-only scalar (unchanged, fail-safe).
+     * `accountStage`). Since the §4.4b Step-1 expand, trust WIDTH no longer
+     * keys on this tier: every synth passes the account id, so the `FjallDeploy`
+     * machine subject accepts `[generic, acct]` (StringEquals array = OR of
+     * exact literals) for EVERY tier, letting per-account deploy issuance flip.
+     * The tier now gates only the `machineTrustMode: "account-scoped"` contract
+     * (governance-only until §4.4b's probe gate) and the boundary preset.
      */
     accountTier?: AccountTier;
     /**

package/dist/lib/config/aws/oidcConnector.js

@@ -74,7 +74,7 @@ export class OidcConnector extends Construct {
         const issuerDomain = FJALL_OIDC_ISSUER_DOMAIN;
         const issuerUrl = `https://${issuerDomain}`;
         const providerResource = new CustomResource(this, "OidcProvider", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Adopt-or-create the account-global Fjall OIDC provider",
             resourceType: "Custom::FjallOidcProvider",

package/dist/lib/config/aws/s3BlockPublicAccess.js

@@ -25,7 +25,7 @@ export class S3BlockPublicAccess extends Construct {
         const account = getConfig().providerAccounts.find((pa) => pa.id === props.accountId);
         const enforce = (account?.s3BlockPublicAccess ?? "off") === "enforced";
         new CustomResource(this, "S3BlockPublicAccess", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Manages S3 Block Public Access at account level",
             rolePath: "/fjall/",

package/dist/lib/config/aws/securityServicesAdmin.js

@@ -35,7 +35,7 @@ export class SecurityServicesAdmin extends Construct {
     }
     createGuardDutyAdmin() {
         new CustomResource(this, "GuardDutyOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures GuardDuty organisation-wide auto-enablement",
             inlinePolicy: [
@@ -70,7 +70,7 @@ exports.handler = async (event) => {
     }
     createSecurityHubAdmin() {
         new CustomResource(this, "SecurityHubOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures SecurityHub organisation-wide auto-enablement",
             inlinePolicy: [

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -6549,15 +6549,15 @@ var require_parser = __commonJS({
     var helper_1 = require_helper();
     var storage_1 = require_storage();
     var AsnParser = class {
-      static parse(data, target) {
-        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data));
+      static parse(data, target, options) {
+        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data), options?.berOptions);
         if (asn1Parsed.result.error) {
           throw new Error(asn1Parsed.result.error);
         }
-        const res = this.fromASN(asn1Parsed.result, target);
+        const res = this.fromASN(asn1Parsed.result, target, options);
         return res;
       }
-      static fromASN(asn1Schema, target) {
+      static fromASN(asn1Schema, target, options) {
         try {
           if ((0, helper_1.isConvertible)(target)) {
             const value = new target();
@@ -6566,7 +6566,7 @@ var require_parser = __commonJS({
           const schema = storage_1.schemaStorage.get(target);
           storage_1.schemaStorage.cache(target);
           let targetSchema = schema.schema;
-          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema);
+          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema, options);
           if (choiceResult?.result) {
             return choiceResult.result;
           }
@@ -6576,9 +6576,9 @@ var require_parser = __commonJS({
           const sequenceResult = this.handleSequenceTypes(asn1Schema, schema, target, targetSchema);
           const res = new target();
           if ((0, helper_1.isTypeOfArray)(target)) {
-            return this.handleArrayTypes(asn1Schema, schema, target);
+            return this.handleArrayTypes(asn1Schema, schema, target, options);
           }
-          this.processSchemaItems(schema, sequenceResult, res);
+          this.processSchemaItems(schema, sequenceResult, res, options);
           return res;
         } catch (error) {
           if (error instanceof errors_1.AsnSchemaValidationError) {
@@ -6587,7 +6587,7 @@ var require_parser = __commonJS({
           throw error;
         }
       }
-      static handleChoiceTypes(asn1Schema, schema, target, targetSchema) {
+      static handleChoiceTypes(asn1Schema, schema, target, targetSchema, options) {
         if (asn1Schema.constructor === asn1js.Constructed && schema.type === enums_1.AsnTypeTypes.Choice && asn1Schema.idBlock.tagClass === 3) {
           for (const key in schema.items) {
             const schemaItem = schema.items[key];
@@ -6598,7 +6598,7 @@ var require_parser = __commonJS({
                   const newSeq = new asn1js.Sequence();
                   if ("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value) && "value" in newSeq.valueBlock) {
                     newSeq.valueBlock.value = asn1Schema.valueBlock.value;
-                    const fieldValue = this.fromASN(newSeq, schemaItem.type);
+                    const fieldValue = this.fromASN(newSeq, schemaItem.type, options);
                     const res = new target();
                     res[key] = fieldValue;
                     return { result: res };
@@ -6689,7 +6689,7 @@ var require_parser = __commonJS({
           throw err;
         }
       }
-      static handleArrayTypes(asn1Schema, schema, target) {
+      static handleArrayTypes(asn1Schema, schema, target, options) {
         if (!("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value))) {
           throw new Error("Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.");
         }
@@ -6701,10 +6701,10 @@ var require_parser = __commonJS({
           }
           return target.from(asn1Schema.valueBlock.value, (element) => converter.fromASN(element));
         } else {
-          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType));
+          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType, options));
         }
       }
-      static processSchemaItems(schema, asn1ComparedSchema, res) {
+      static processSchemaItems(schema, asn1ComparedSchema, res, options) {
         for (const key in schema.items) {
           const asn1SchemaValue = asn1ComparedSchema.result[key];
           if (!asn1SchemaValue) {
@@ -6714,9 +6714,9 @@ var require_parser = __commonJS({
           const schemaItemType = schemaItem.type;
           let parsedValue;
           if (typeof schemaItemType === "number" || (0, helper_1.isConvertible)(schemaItemType)) {
-            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           } else {
-            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           }
           if (parsedValue && typeof parsedValue === "object" && "value" in parsedValue && "raw" in parsedValue) {
             res[key] = parsedValue.value;
@@ -6726,23 +6726,23 @@ var require_parser = __commonJS({
           }
         }
       }
-      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         const converter = schemaItem.converter ?? ((0, helper_1.isConvertible)(schemaItemType) ? new schemaItemType() : null);
         if (!converter) {
           throw new Error("Converter is empty");
         }
         if (schemaItem.repeated) {
-          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter);
+          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options);
         } else {
-          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter);
+          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options);
         }
       }
-      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter) {
+      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options) {
         if (schemaItem.implicit) {
           const Container = schemaItem.repeated === "sequence" ? asn1js.Sequence : asn1js.Set;
           const newItem = new Container();
           newItem.valueBlock = asn1SchemaValue.valueBlock;
-          const newItemAsn = asn1js.fromBER(newItem.toBER(false));
+          const newItemAsn = asn1js.fromBER(newItem.toBER(false), options?.berOptions);
           if (newItemAsn.offset === -1) {
             throw new Error(`Cannot parse the child item. ${newItemAsn.result.error}`);
           }
@@ -6755,7 +6755,7 @@ var require_parser = __commonJS({
           return Array.from(asn1SchemaValue, (element) => converter.fromASN(element));
         }
       }
-      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter) {
+      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options) {
         let value = asn1SchemaValue;
         if (schemaItem.implicit) {
           let newItem;
@@ -6770,21 +6770,21 @@ var require_parser = __commonJS({
             newItem = new Asn1Type();
           }
           newItem.valueBlock = value.valueBlock;
-          value = asn1js.fromBER(newItem.toBER(false)).result;
+          value = asn1js.fromBER(newItem.toBER(false), options?.berOptions).result;
         }
         return converter.fromASN(value);
       }
-      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         if (schemaItem.repeated) {
           if (!Array.isArray(asn1SchemaValue)) {
             throw new Error("Cannot get list of items from the ASN.1 parsed value. ASN.1 value should be iterable.");
           }
-          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType));
+          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType, options));
         } else {
           const valueToProcess = this.handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType);
           if (this.isOptionalChoiceField(schemaItem)) {
             try {
-              return this.fromASN(valueToProcess, schemaItemType);
+              return this.fromASN(valueToProcess, schemaItemType, options);
             } catch (err) {
               if (err instanceof errors_1.AsnSchemaValidationError && /Wrong values for Choice type/.test(err.message)) {
                 return void 0;
@@ -6792,7 +6792,7 @@ var require_parser = __commonJS({
               throw err;
             }
           } else {
-            const parsedValue = this.fromASN(valueToProcess, schemaItemType);
+            const parsedValue = this.fromASN(valueToProcess, schemaItemType, options);
             if (schemaItem.raw) {
               return {
                 value: parsedValue,
@@ -7009,12 +7009,12 @@ var require_convert = __commonJS({
       static serialize(obj) {
         return serializer_1.AsnSerializer.serialize(obj);
       }
-      static parse(data, target) {
-        return parser_1.AsnParser.parse(data, target);
+      static parse(data, target, options) {
+        return parser_1.AsnParser.parse(data, target, options);
       }
-      static toString(data) {
+      static toString(data, options) {
         const buf = (0, bytes_1.isBufferSource)(data) ? (0, bytes_1.toArrayBuffer)(data) : _AsnConvert.serialize(data);
-        const asn = asn1js.fromBER(buf);
+        const asn = asn1js.fromBER(buf, options?.berOptions);
         if (asn.offset === -1) {
           throw new Error(`Cannot decode ASN.1 data. ${asn.result.error}`);
         }
@@ -14678,9 +14678,9 @@ var require_cjs11 = __commonJS({
   }
 });
 
-// node_modules/@peculiar/x509/build/x509.cjs.js
+// ../../node_modules/@peculiar/x509/build/x509.cjs.js
 var require_x509_cjs = __commonJS({
-  "node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
+  "../../node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
     "use strict";
     var asn1Schema = require_cjs();
     var asn1X509 = require_cjs2();

package/dist/lib/patterns/aws/account.d.ts

@@ -61,16 +61,17 @@ export declare class Account extends Stack {
      */
     protected receivesDeployRole(): boolean;
     /**
-     * Account TIER passed to this account's `OidcConnector` for the §4.4a
-     * deploy-trust governance expand. A polymorphic METHOD, not a read of the
-     * `organisationType` field: the connector is instantiated in THIS base
-     * constructor, and subclass field initialisers run AFTER `super()`, so
-     * `this.organisationType` would read "account" for every subclass here (the
-     * same construction-order reason `receivesDeployRole()` is a method). Base ⇒
-     * "account" (app-tier, generic-only trust); `Platform` ⇒ "platform" and
-     * `Organisation` ⇒ "organisation" override. Governance tiers widen the deploy
-     * machine subject; kept in lockstep with `organisationType` by the
-     * Platform-synth deploy-trust parity test.
+     * Account TIER passed to this account's `OidcConnector`. A polymorphic
+     * METHOD, not a read of the `organisationType` field: the connector is
+     * instantiated in THIS base constructor, and subclass field initialisers run
+     * AFTER `super()`, so `this.organisationType` would read "account" for every
+     * subclass here (the same construction-order reason `receivesDeployRole()`
+     * is a method). Base ⇒ "account"; `Platform` ⇒ "platform" and `Organisation`
+     * ⇒ "organisation" override. Since the §4.4b Step-1 expand every tier
+     * renders the widened `[generic, acct]` machine subject — the tier now gates
+     * only the governance-only "account-scoped" contract mode (the builder
+     * throws for tier "account"); kept in lockstep with `organisationType` by
+     * the Platform-synth deploy-trust parity test.
      */
     protected deployRoleAccountTier(): AccountTier;
     /**

package/dist/lib/patterns/aws/account.js

@@ -151,16 +151,17 @@ export class Account extends Stack {
         return this.constructor === Account;
     }
     /**
-     * Account TIER passed to this account's `OidcConnector` for the §4.4a
-     * deploy-trust governance expand. A polymorphic METHOD, not a read of the
-     * `organisationType` field: the connector is instantiated in THIS base
-     * constructor, and subclass field initialisers run AFTER `super()`, so
-     * `this.organisationType` would read "account" for every subclass here (the
-     * same construction-order reason `receivesDeployRole()` is a method). Base ⇒
-     * "account" (app-tier, generic-only trust); `Platform` ⇒ "platform" and
-     * `Organisation` ⇒ "organisation" override. Governance tiers widen the deploy
-     * machine subject; kept in lockstep with `organisationType` by the
-     * Platform-synth deploy-trust parity test.
+     * Account TIER passed to this account's `OidcConnector`. A polymorphic
+     * METHOD, not a read of the `organisationType` field: the connector is
+     * instantiated in THIS base constructor, and subclass field initialisers run
+     * AFTER `super()`, so `this.organisationType` would read "account" for every
+     * subclass here (the same construction-order reason `receivesDeployRole()`
+     * is a method). Base ⇒ "account"; `Platform` ⇒ "platform" and `Organisation`
+     * ⇒ "organisation" override. Since the §4.4b Step-1 expand every tier
+     * renders the widened `[generic, acct]` machine subject — the tier now gates
+     * only the governance-only "account-scoped" contract mode (the builder
+     * throws for tier "account"); kept in lockstep with `organisationType` by
+     * the Platform-synth deploy-trust parity test.
      */
     deployRoleAccountTier() {
         return "account";

package/dist/lib/patterns/aws/clickhouseDatabase.d.ts

@@ -17,9 +17,22 @@ export interface ClickHouseDatabaseProps {
     type: "ClickHouse";
     /** VPC to deploy into. Falls back to `app.getVpc()` via the factory. */
     vpc?: IVpc;
-    /** EC2 instance type. Default: `m7g.medium` (1 vCPU sustained, 4 GiB).
-     *  CH user-data is tuned for 1 vCPU; raise per-user `max_threads` and
-     *  `max_concurrent_queries` if bumping to a >=2 vCPU host. */
+    /** EC2 instance type. Default: `m7g.medium` (1 vCPU sustained, 4 GiB);
+     *  recommended step-up `r8g.medium` (8 GiB — see
+     *  `DEFAULT_CLICKHOUSE_INSTANCE_TYPE`). Must appear in
+     *  `CLICKHOUSE_INSTANCE_MEMORY_GIB` — the container memory limit derives
+     *  from it via `clickHouseTaskMemoryMiB()` and unknown types throw at
+     *  synth. CH user-data is tuned for 1 vCPU; raise per-user `max_threads`
+     *  and `max_concurrent_queries` if bumping to a >=2 vCPU host.
+     *
+     *  WARNING — changing this on a DEPLOYED stack REPLACES the persistent
+     *  data volume, not just the instance. The instance type is embedded in
+     *  the compute construct's logical-ID key (`getEc2ConfigKey`), so the
+     *  `AWS::EC2::Volume` beneath it gets a new logical ID: CloudFormation
+     *  snapshots-then-deletes the old volume (`RemovalPolicy.SNAPSHOT`) and
+     *  creates an EMPTY one, and the volume's `ownerLogicalId` re-attach tag
+     *  chain resets. Plan a snapshot-restore migration for live data — this
+     *  is NOT a config-only change on a stack with data. */
     instanceType?: string;
     /**
      * ECS service desired task count. Defaults to 1 (single-node, single-task

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -22,7 +22,7 @@ import { resolveAlertsTopic } from "../../utils/resolveAlertsTopic.js";
 import { createClickHouseAlarms } from "../../resources/aws/monitoring/index.js";
 import { ClickHouseSchemaAdminSchema, ManagedPasswordNameSchema, ProfileSpecSchema, ClickHouseDefaultProfiles, PROFILE_NAME_PATTERN } from "../../resources/aws/database/clickhouseSchemas.js";
 import { inferAmiHardwareType } from "../../resources/aws/compute/ecsConstants.js";
-import { CLICKHOUSE_DATABASE_NAME, DEFAULT_CLICKHOUSE_INSTANCE_TYPE, CLICKHOUSE_IMAGE, CLICKHOUSE_EBS_VOLUME_SIZE_GB, CLICKHOUSE_EBS_IOPS, CLICKHOUSE_EBS_THROUGHPUT_MBPS, CLICKHOUSE_TASK_MEMORY_MIB, CLICKHOUSE_HTTP_PORT, CLICKHOUSE_HTTPS_PORT, CLICKHOUSE_NATIVE_PORT, CLICKHOUSE_TCP_SECURE_PORT, CLICKHOUSE_TLS_CERT_MOUNT_PATH, CLICKHOUSE_PROMETHEUS_PORT, CLICKHOUSE_DATA_MOUNT_PATH, CLICKHOUSE_SECRET_OPTIONS, CLICKHOUSE_SERVER_ROLE_TAG, clickHouseUserSecretName, CLICKHOUSE_HEALTH_CHECK, CLICKHOUSE_STOP_TIMEOUT_SECONDS, CLICKHOUSE_EBS_DEVICE_NAME, CLICKHOUSE_CONFIG_SUBDIR, CLICKHOUSE_USERS_SUBDIR, userPasswordEnvName, OPTIMISE_FINAL_SCHEDULE, REPLACING_MERGE_TREE_TABLES, OPTIMISE_MV_TABLES, CLICKHOUSE_CLOUDMAP_SERVICE_NAME, CLICKHOUSE_SERVER_CONTAINER_NAME, OPTIMISE_TASK_MEMORY_MIB, OPTIMISE_TASK_CPU_UNITS, BACKUP_SCHEDULE, BACKUP_TASK_MEMORY_MIB, BACKUP_TASK_CPU_UNITS, BACKUP_RETENTION_DAYS } from "../../resources/aws/database/clickhouseConstants.js";
+import { CLICKHOUSE_DATABASE_NAME, DEFAULT_CLICKHOUSE_INSTANCE_TYPE, CLICKHOUSE_IMAGE, CLICKHOUSE_EBS_VOLUME_SIZE_GB, CLICKHOUSE_EBS_IOPS, CLICKHOUSE_EBS_THROUGHPUT_MBPS, clickHouseTaskMemoryMiB, CLICKHOUSE_HTTP_PORT, CLICKHOUSE_HTTPS_PORT, CLICKHOUSE_NATIVE_PORT, CLICKHOUSE_TCP_SECURE_PORT, CLICKHOUSE_TLS_CERT_MOUNT_PATH, CLICKHOUSE_PROMETHEUS_PORT, CLICKHOUSE_DATA_MOUNT_PATH, CLICKHOUSE_SECRET_OPTIONS, CLICKHOUSE_SERVER_ROLE_TAG, CLICKHOUSE_HOST_METRICS, clickHouseUserSecretName, CLICKHOUSE_HEALTH_CHECK, CLICKHOUSE_STOP_TIMEOUT_SECONDS, CLICKHOUSE_EBS_DEVICE_NAME, CLICKHOUSE_CONFIG_SUBDIR, CLICKHOUSE_USERS_SUBDIR, userPasswordEnvName, OPTIMISE_FINAL_SCHEDULE, REPLACING_MERGE_TREE_TABLES, OPTIMISE_MV_TABLES, CLICKHOUSE_CLOUDMAP_SERVICE_NAME, CLICKHOUSE_SERVER_CONTAINER_NAME, OPTIMISE_TASK_MEMORY_MIB, OPTIMISE_TASK_CPU_UNITS, BACKUP_SCHEDULE, BACKUP_TASK_MEMORY_MIB, BACKUP_TASK_CPU_UNITS, BACKUP_RETENTION_DAYS } from "../../resources/aws/database/clickhouseConstants.js";
 import { TlsCertGenerator } from "../../resources/aws/utilities/tlsCertGenerator.js";
 import { EcsCompute } from "./computeEcs.js";
 /**
@@ -375,6 +375,10 @@ export class ClickHouseDatabase extends Construct {
                     name: "ClickHouseService",
                     capacityProvider: "EC2",
                     desiredCount,
+                    // Omitting `scaling` attaches default CPU target tracking. A scaled-out
+                    // second task is an EMPTY second database behind the same Cloud Map name
+                    // (plain MergeTree does not replicate) — desired-count scaling stays off.
+                    scaling: false,
                     serviceDiscovery: {
                         name: CLICKHOUSE_CLOUDMAP_SERVICE_NAME,
                         // getaddrinfo clients require A; AWS rejects A under HOST/BRIDGE → AWS_VPC.
@@ -403,7 +407,7 @@ export class ClickHouseDatabase extends Construct {
                         desiredCapacity: 1,
                         minCapacity: 1,
                         maxCapacity: 1,
-                        memoryLimitMiB: CLICKHOUSE_TASK_MEMORY_MIB,
+                        memoryLimitMiB: clickHouseTaskMemoryMiB(instanceType),
                         tags: {
                             [CLICKHOUSE_SERVER_ROLE_TAG.key]: CLICKHOUSE_SERVER_ROLE_TAG.value
                         }
@@ -493,6 +497,23 @@ export class ClickHouseDatabase extends Construct {
             tlsCaSecret.grantRead(instanceRole);
         if (tlsServerSecret !== undefined)
             tlsServerSecret.grantRead(instanceRole);
+        // For the user-data host-metrics timer (see buildClickHouseUserData).
+        // PutMetricData is not resource-scopable; the namespace condition bounds
+        // the grant to the CWAgent metrics the host alarms consume. The describe
+        // grant backs the IMDS-tag fallback path for ASG-name resolution.
+        instanceRole.addToPrincipalPolicy(new PolicyStatement({
+            actions: ["cloudwatch:PutMetricData"],
+            resources: ["*"],
+            conditions: {
+                StringEquals: {
+                    "cloudwatch:namespace": CLICKHOUSE_HOST_METRICS.namespace
+                }
+            }
+        }));
+        instanceRole.addToPrincipalPolicy(new PolicyStatement({
+            actions: ["autoscaling:DescribeAutoScalingInstances"],
+            resources: ["*"]
+        }));
         // asgName is the CloudWatch dimension the host metrics key off, so without
         // it the alarms cannot be built; no topic is the default, so skip silently
         // rather than throw.

package/dist/lib/patterns/aws/compute.js

@@ -78,7 +78,7 @@ export const COMPUTE_DEFAULTS = {
     },
     LAMBDA: {
         HANDLER: "index.handler",
-        RUNTIME: Runtime.NODEJS_22_X,
+        RUNTIME: Runtime.NODEJS_24_X,
         ARCHITECTURE: Architecture.ARM_64
     }
 };

package/dist/lib/patterns/aws/computeEcs.js

@@ -26,6 +26,7 @@ import { VALIDATION_PATTERNS } from "@fjall/generator";
 import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab, buildParameterPath } from "@fjall/util";
 import { validateEc2ServiceSizing, validateEcsDomainConfig, validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
+import { validateSharedEc2CapacityConfig } from "../../resources/aws/compute/ecsCapacityConfig.js";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -174,6 +175,10 @@ export function validateEcsProps(props) {
             validateSeparateTaskDef(service.name, service.migrations.separateTaskDef);
         }
     }
+    // Mirror of the resources-layer shared-ASG capacity check (drift on a reused
+    // ASG, shared persistentDataVolume singleton) — defence-in-depth per
+    // generator-standards § "Validate at the Lowest Layer the Field Belongs To".
+    validateSharedEc2CapacityConfig(props.services);
     // Validate awaitMigrationsFrom cross-service migration ordering.
     const serviceByName = new Map(props.services.map((s) => [s.name, s]));
     for (const service of props.services) {

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -622,9 +622,19 @@ export interface EcsServiceConfig {
      * ]
      */
     routing?: EcsRoutingConfig | EcsRoutingConfig[];
-    /** CPU units for this service's tasks (256-4096) */
+    /**
+     * CPU units for this service's tasks (256-4096). Fargate only — EC2 task
+     * definitions carry no task-level CPU reservation (CPU is bounded by the
+     * instance type), so a value here is rejected at synth when `capacityProvider`
+     * is 'EC2' (see `validateEc2ServiceSizing`).
+     */
     cpu?: number;
-    /** Memory in MiB for this service's tasks (512-30720) */
+    /**
+     * Memory in MiB for this service's tasks (512-30720). Fargate only — for EC2
+     * capacity the container memory comes from `ec2Config.memoryLimitMiB`; a
+     * service-level value here is rejected at synth unless it exactly mirrors
+     * that field (see `validateEc2ServiceSizing`).
+     */
     memoryLimitMiB?: number;
     /** Desired number of tasks. Default: 2 */
     desiredCount?: number;

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -201,7 +201,7 @@ export interface CodeLambdaProps extends BaseLambdaProps {
     code: Code;
     /** Handler function. Default: "index.handler" */
     handler?: string;
-    /** Lambda runtime. Default: NODEJS_22_X */
+    /** Lambda runtime. Default: NODEJS_24_X */
     runtime?: Runtime;
 }
 /**

package/dist/lib/patterns/aws/database.js

@@ -16,15 +16,15 @@ import { Duration } from "aws-cdk-lib";
 export { isAwsManagedKey, isCMKRequested, AWS_MANAGED, USE_CMK } from "../../utils/databaseTypes.js";
 export const DATABASE_ENGINE_CONFIG = Object.freeze({
     postgresql: {
-        aurora: { version: "16.10", majorVersion: "16" },
-        instance: { version: "17.5", majorVersion: "17" },
+        aurora: { version: "18.4", majorVersion: "18" },
+        instance: { version: "17.9", majorVersion: "17" },
         defaultUsername: "postgres",
         sslParameters: { "rds.force_ssl": "1" }
     },
     mysql: {
-        // majorVersion must be Aurora version (3.08.0), NOT MySQL version (8.0)
-        aurora: { version: "8.0.mysql_aurora.3.08.0", majorVersion: "3.08.0" },
-        instance: { version: "8.4.4", majorVersion: "8.4" },
+        // majorVersion must be Aurora version (3.12.0), NOT MySQL version (8.0)
+        aurora: { version: "8.0.mysql_aurora.3.12.0", majorVersion: "3.12.0" },
+        instance: { version: "8.4.9", majorVersion: "8.4" },
         defaultUsername: "admin",
         sslParameters: { require_secure_transport: "ON" }
     }

package/dist/lib/patterns/aws/devSubstrate.js

@@ -317,7 +317,7 @@ export class DevSubstrate extends Construct {
         // control plane (ECS / Aurora / SSM), never over the VPC, and the ALB invokes
         // it through the Lambda API — not the network path.
         const waker = new LambdaFunction(this, DEV_SUBSTRATE_WAKER_ID, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: "Dev substrate slot waker",

package/dist/lib/patterns/aws/payload.js

@@ -308,7 +308,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.SERVER}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -370,7 +370,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.IMAGE}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -396,7 +396,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.REVALIDATION}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,

package/dist/lib/patterns/aws/staticSite.js

@@ -42,7 +42,7 @@ import { toPascalCase } from "../../utils/capitaliseString.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const FORMS_ASSET_DIR = resolve(__dirname, "../../lambda-assets/static-site-forms/asset");
 const FORMS_DEFAULTS = {
-    RUNTIME: Runtime.NODEJS_22_X,
+    RUNTIME: Runtime.NODEJS_24_X,
     ARCHITECTURE: Architecture.ARM_64,
     TIMEOUT_SECONDS: 10,
     MEMORY_MB: 256,

package/dist/lib/resources/aws/compute/ec2GracefulTerminationHandler.js

@@ -144,7 +144,7 @@ export class Ec2GracefulTerminationHandler extends Construct {
             ]
             : [];
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: `${id} ${EC2_GRACEFUL_TERMINATION_HANDLER_DESCRIPTION}`,

package/dist/lib/resources/aws/compute/ecs.js

@@ -66,6 +66,7 @@ export default class EcsCluster extends Construct {
     // EC2-specific (mutable state shared with ecsServiceFactory)
     asgState = {
         providers: new Map(),
+        asgOrigins: new Map(),
         autoScalingGroup: undefined,
         asgSecurityGroup: undefined
     };

package/dist/lib/resources/aws/compute/ecsCapacityConfig.d.ts

@@ -0,0 +1,43 @@
+import type { Ec2CapacityConfig, EcsCapacityProvider } from "./ecsTypes.js";
+/** The service + ec2Config that first claimed an EC2 capacity key. */
+export interface Ec2AsgOrigin {
+    serviceName: string;
+    ec2Config: Ec2CapacityConfig;
+}
+/**
+ * Rejects at synth when a service reusing a shared ASG is incompatible with
+ * it: either the origin's `persistentDataVolume` makes the ASG a singleton
+ * (two tasks would race to attach the same EBS volume), or the reusing
+ * service asks for ASG settings that differ from the ones the ASG was built
+ * with — those settings would be silently ignored (same silent-ignore class
+ * as `validateEc2ServiceSizing`).
+ */
+export declare function assertSharedAsgConfigMatches(serviceName: string, ec2Config: Ec2CapacityConfig, key: string, origin: Ec2AsgOrigin): void;
+/**
+ * Generates a unique key for EC2 config so services with matching
+ * configurations share an ASG.
+ */
+export declare function getEc2ConfigKey(ec2Config: Ec2CapacityConfig): string;
+/**
+ * Minimal structural input for {@link validateSharedEc2CapacityConfig} —
+ * exactly the fields the check reads. Both the resources-layer
+ * `EcsServiceProps` and the patterns-layer `EcsServiceConfig` structurally
+ * satisfy it (typescript-standards § "Helpers consume resolved state, not the
+ * dispatch enum").
+ */
+export interface SharedEc2CapacityServiceInput {
+    name: string;
+    capacityProvider?: EcsCapacityProvider;
+    ec2Config?: Ec2CapacityConfig;
+}
+/**
+ * Cross-service shared-ASG compatibility: groups EC2 services by their
+ * capacity key and rejects a reuse that is incompatible with the ASG's origin
+ * — config drift the shared ASG would silently discard, or a
+ * `persistentDataVolume` singleton being shared. Pure; called from BOTH
+ * validation layers — resources `validateEcsClusterProps` and patterns
+ * `validateEcsProps` (generator-standards § "Validate at the Lowest Layer the
+ * Field Belongs To") — with the same check at the construction site
+ * (`getOrCreateAsgCapacityProvider`) as defence-in-depth.
+ */
+export declare function validateSharedEc2CapacityConfig(services: readonly SharedEc2CapacityServiceInput[]): void;