@fjall/components-infrastructure 5.0.0 → 6.0.0

package/dist/lib/config/aws/ebsDefaultEncryption.js

@@ -11,7 +11,7 @@ export class EbsDefaultEncryption extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "EbsDefaultEncryption", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables EBS default encryption at account level",
             inlinePolicy: [

package/dist/lib/config/aws/inspectorEnablement.js

@@ -12,7 +12,7 @@ export class InspectorEnablement extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "InspectorEnable", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables/disables Inspector v2 for the account",
             inlinePolicy: [

package/dist/lib/config/aws/oidcConnector.js

@@ -74,7 +74,7 @@ export class OidcConnector extends Construct {
         const issuerDomain = FJALL_OIDC_ISSUER_DOMAIN;
         const issuerUrl = `https://${issuerDomain}`;
         const providerResource = new CustomResource(this, "OidcProvider", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Adopt-or-create the account-global Fjall OIDC provider",
             resourceType: "Custom::FjallOidcProvider",

package/dist/lib/config/aws/s3BlockPublicAccess.js

@@ -25,7 +25,7 @@ export class S3BlockPublicAccess extends Construct {
         const account = getConfig().providerAccounts.find((pa) => pa.id === props.accountId);
         const enforce = (account?.s3BlockPublicAccess ?? "off") === "enforced";
         new CustomResource(this, "S3BlockPublicAccess", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Manages S3 Block Public Access at account level",
             rolePath: "/fjall/",

package/dist/lib/config/aws/securityServicesAdmin.js

@@ -35,7 +35,7 @@ export class SecurityServicesAdmin extends Construct {
     }
     createGuardDutyAdmin() {
         new CustomResource(this, "GuardDutyOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures GuardDuty organisation-wide auto-enablement",
             inlinePolicy: [
@@ -70,7 +70,7 @@ exports.handler = async (event) => {
     }
     createSecurityHubAdmin() {
         new CustomResource(this, "SecurityHubOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures SecurityHub organisation-wide auto-enablement",
             inlinePolicy: [

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -6549,15 +6549,15 @@ var require_parser = __commonJS({
     var helper_1 = require_helper();
     var storage_1 = require_storage();
     var AsnParser = class {
-      static parse(data, target) {
-        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data));
+      static parse(data, target, options) {
+        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data), options?.berOptions);
         if (asn1Parsed.result.error) {
           throw new Error(asn1Parsed.result.error);
         }
-        const res = this.fromASN(asn1Parsed.result, target);
+        const res = this.fromASN(asn1Parsed.result, target, options);
         return res;
       }
-      static fromASN(asn1Schema, target) {
+      static fromASN(asn1Schema, target, options) {
         try {
           if ((0, helper_1.isConvertible)(target)) {
             const value = new target();
@@ -6566,7 +6566,7 @@ var require_parser = __commonJS({
           const schema = storage_1.schemaStorage.get(target);
           storage_1.schemaStorage.cache(target);
           let targetSchema = schema.schema;
-          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema);
+          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema, options);
           if (choiceResult?.result) {
             return choiceResult.result;
           }
@@ -6576,9 +6576,9 @@ var require_parser = __commonJS({
           const sequenceResult = this.handleSequenceTypes(asn1Schema, schema, target, targetSchema);
           const res = new target();
           if ((0, helper_1.isTypeOfArray)(target)) {
-            return this.handleArrayTypes(asn1Schema, schema, target);
+            return this.handleArrayTypes(asn1Schema, schema, target, options);
           }
-          this.processSchemaItems(schema, sequenceResult, res);
+          this.processSchemaItems(schema, sequenceResult, res, options);
           return res;
         } catch (error) {
           if (error instanceof errors_1.AsnSchemaValidationError) {
@@ -6587,7 +6587,7 @@ var require_parser = __commonJS({
           throw error;
         }
       }
-      static handleChoiceTypes(asn1Schema, schema, target, targetSchema) {
+      static handleChoiceTypes(asn1Schema, schema, target, targetSchema, options) {
         if (asn1Schema.constructor === asn1js.Constructed && schema.type === enums_1.AsnTypeTypes.Choice && asn1Schema.idBlock.tagClass === 3) {
           for (const key in schema.items) {
             const schemaItem = schema.items[key];
@@ -6598,7 +6598,7 @@ var require_parser = __commonJS({
                   const newSeq = new asn1js.Sequence();
                   if ("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value) && "value" in newSeq.valueBlock) {
                     newSeq.valueBlock.value = asn1Schema.valueBlock.value;
-                    const fieldValue = this.fromASN(newSeq, schemaItem.type);
+                    const fieldValue = this.fromASN(newSeq, schemaItem.type, options);
                     const res = new target();
                     res[key] = fieldValue;
                     return { result: res };
@@ -6689,7 +6689,7 @@ var require_parser = __commonJS({
           throw err;
         }
       }
-      static handleArrayTypes(asn1Schema, schema, target) {
+      static handleArrayTypes(asn1Schema, schema, target, options) {
         if (!("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value))) {
           throw new Error("Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.");
         }
@@ -6701,10 +6701,10 @@ var require_parser = __commonJS({
           }
           return target.from(asn1Schema.valueBlock.value, (element) => converter.fromASN(element));
         } else {
-          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType));
+          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType, options));
         }
       }
-      static processSchemaItems(schema, asn1ComparedSchema, res) {
+      static processSchemaItems(schema, asn1ComparedSchema, res, options) {
         for (const key in schema.items) {
           const asn1SchemaValue = asn1ComparedSchema.result[key];
           if (!asn1SchemaValue) {
@@ -6714,9 +6714,9 @@ var require_parser = __commonJS({
           const schemaItemType = schemaItem.type;
           let parsedValue;
           if (typeof schemaItemType === "number" || (0, helper_1.isConvertible)(schemaItemType)) {
-            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           } else {
-            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           }
           if (parsedValue && typeof parsedValue === "object" && "value" in parsedValue && "raw" in parsedValue) {
             res[key] = parsedValue.value;
@@ -6726,23 +6726,23 @@ var require_parser = __commonJS({
           }
         }
       }
-      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         const converter = schemaItem.converter ?? ((0, helper_1.isConvertible)(schemaItemType) ? new schemaItemType() : null);
         if (!converter) {
           throw new Error("Converter is empty");
         }
         if (schemaItem.repeated) {
-          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter);
+          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options);
         } else {
-          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter);
+          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options);
         }
       }
-      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter) {
+      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options) {
         if (schemaItem.implicit) {
           const Container = schemaItem.repeated === "sequence" ? asn1js.Sequence : asn1js.Set;
           const newItem = new Container();
           newItem.valueBlock = asn1SchemaValue.valueBlock;
-          const newItemAsn = asn1js.fromBER(newItem.toBER(false));
+          const newItemAsn = asn1js.fromBER(newItem.toBER(false), options?.berOptions);
           if (newItemAsn.offset === -1) {
             throw new Error(`Cannot parse the child item. ${newItemAsn.result.error}`);
           }
@@ -6755,7 +6755,7 @@ var require_parser = __commonJS({
           return Array.from(asn1SchemaValue, (element) => converter.fromASN(element));
         }
       }
-      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter) {
+      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options) {
         let value = asn1SchemaValue;
         if (schemaItem.implicit) {
           let newItem;
@@ -6770,21 +6770,21 @@ var require_parser = __commonJS({
             newItem = new Asn1Type();
           }
           newItem.valueBlock = value.valueBlock;
-          value = asn1js.fromBER(newItem.toBER(false)).result;
+          value = asn1js.fromBER(newItem.toBER(false), options?.berOptions).result;
         }
         return converter.fromASN(value);
       }
-      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         if (schemaItem.repeated) {
           if (!Array.isArray(asn1SchemaValue)) {
             throw new Error("Cannot get list of items from the ASN.1 parsed value. ASN.1 value should be iterable.");
           }
-          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType));
+          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType, options));
         } else {
           const valueToProcess = this.handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType);
           if (this.isOptionalChoiceField(schemaItem)) {
             try {
-              return this.fromASN(valueToProcess, schemaItemType);
+              return this.fromASN(valueToProcess, schemaItemType, options);
             } catch (err) {
               if (err instanceof errors_1.AsnSchemaValidationError && /Wrong values for Choice type/.test(err.message)) {
                 return void 0;
@@ -6792,7 +6792,7 @@ var require_parser = __commonJS({
               throw err;
             }
           } else {
-            const parsedValue = this.fromASN(valueToProcess, schemaItemType);
+            const parsedValue = this.fromASN(valueToProcess, schemaItemType, options);
             if (schemaItem.raw) {
               return {
                 value: parsedValue,
@@ -7009,12 +7009,12 @@ var require_convert = __commonJS({
       static serialize(obj) {
         return serializer_1.AsnSerializer.serialize(obj);
       }
-      static parse(data, target) {
-        return parser_1.AsnParser.parse(data, target);
+      static parse(data, target, options) {
+        return parser_1.AsnParser.parse(data, target, options);
       }
-      static toString(data) {
+      static toString(data, options) {
         const buf = (0, bytes_1.isBufferSource)(data) ? (0, bytes_1.toArrayBuffer)(data) : _AsnConvert.serialize(data);
-        const asn = asn1js.fromBER(buf);
+        const asn = asn1js.fromBER(buf, options?.berOptions);
         if (asn.offset === -1) {
           throw new Error(`Cannot decode ASN.1 data. ${asn.result.error}`);
         }
@@ -14678,9 +14678,9 @@ var require_cjs11 = __commonJS({
   }
 });
 
-// node_modules/@peculiar/x509/build/x509.cjs.js
+// ../../node_modules/@peculiar/x509/build/x509.cjs.js
 var require_x509_cjs = __commonJS({
-  "node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
+  "../../node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
     "use strict";
     var asn1Schema = require_cjs();
     var asn1X509 = require_cjs2();

package/dist/lib/patterns/aws/compute.js

@@ -78,7 +78,7 @@ export const COMPUTE_DEFAULTS = {
     },
     LAMBDA: {
         HANDLER: "index.handler",
-        RUNTIME: Runtime.NODEJS_22_X,
+        RUNTIME: Runtime.NODEJS_24_X,
         ARCHITECTURE: Architecture.ARM_64
     }
 };

package/dist/lib/patterns/aws/computeEcs.js

@@ -26,6 +26,7 @@ import { VALIDATION_PATTERNS } from "@fjall/generator";
 import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab, buildParameterPath } from "@fjall/util";
 import { validateEc2ServiceSizing, validateEcsDomainConfig, validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
+import { validateSharedEc2CapacityConfig } from "../../resources/aws/compute/ecsCapacityConfig.js";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -174,6 +175,10 @@ export function validateEcsProps(props) {
             validateSeparateTaskDef(service.name, service.migrations.separateTaskDef);
         }
     }
+    // Mirror of the resources-layer shared-ASG capacity check (drift on a reused
+    // ASG, shared persistentDataVolume singleton) — defence-in-depth per
+    // generator-standards § "Validate at the Lowest Layer the Field Belongs To".
+    validateSharedEc2CapacityConfig(props.services);
     // Validate awaitMigrationsFrom cross-service migration ordering.
     const serviceByName = new Map(props.services.map((s) => [s.name, s]));
     for (const service of props.services) {

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -201,7 +201,7 @@ export interface CodeLambdaProps extends BaseLambdaProps {
     code: Code;
     /** Handler function. Default: "index.handler" */
     handler?: string;
-    /** Lambda runtime. Default: NODEJS_22_X */
+    /** Lambda runtime. Default: NODEJS_24_X */
     runtime?: Runtime;
 }
 /**

package/dist/lib/patterns/aws/devSubstrate.js

@@ -317,7 +317,7 @@ export class DevSubstrate extends Construct {
         // control plane (ECS / Aurora / SSM), never over the VPC, and the ALB invokes
         // it through the Lambda API — not the network path.
         const waker = new LambdaFunction(this, DEV_SUBSTRATE_WAKER_ID, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: "Dev substrate slot waker",

package/dist/lib/patterns/aws/payload.js

@@ -308,7 +308,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.SERVER}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -370,7 +370,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.IMAGE}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -396,7 +396,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.REVALIDATION}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,

package/dist/lib/patterns/aws/staticSite.js

@@ -42,7 +42,7 @@ import { toPascalCase } from "../../utils/capitaliseString.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const FORMS_ASSET_DIR = resolve(__dirname, "../../lambda-assets/static-site-forms/asset");
 const FORMS_DEFAULTS = {
-    RUNTIME: Runtime.NODEJS_22_X,
+    RUNTIME: Runtime.NODEJS_24_X,
     ARCHITECTURE: Architecture.ARM_64,
     TIMEOUT_SECONDS: 10,
     MEMORY_MB: 256,

package/dist/lib/resources/aws/compute/ec2GracefulTerminationHandler.js

@@ -144,7 +144,7 @@ export class Ec2GracefulTerminationHandler extends Construct {
             ]
             : [];
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: `${id} ${EC2_GRACEFUL_TERMINATION_HANDLER_DESCRIPTION}`,

package/dist/lib/resources/aws/compute/ecsCapacityConfig.d.ts

@@ -0,0 +1,43 @@
+import type { Ec2CapacityConfig, EcsCapacityProvider } from "./ecsTypes.js";
+/** The service + ec2Config that first claimed an EC2 capacity key. */
+export interface Ec2AsgOrigin {
+    serviceName: string;
+    ec2Config: Ec2CapacityConfig;
+}
+/**
+ * Rejects at synth when a service reusing a shared ASG is incompatible with
+ * it: either the origin's `persistentDataVolume` makes the ASG a singleton
+ * (two tasks would race to attach the same EBS volume), or the reusing
+ * service asks for ASG settings that differ from the ones the ASG was built
+ * with — those settings would be silently ignored (same silent-ignore class
+ * as `validateEc2ServiceSizing`).
+ */
+export declare function assertSharedAsgConfigMatches(serviceName: string, ec2Config: Ec2CapacityConfig, key: string, origin: Ec2AsgOrigin): void;
+/**
+ * Generates a unique key for EC2 config so services with matching
+ * configurations share an ASG.
+ */
+export declare function getEc2ConfigKey(ec2Config: Ec2CapacityConfig): string;
+/**
+ * Minimal structural input for {@link validateSharedEc2CapacityConfig} —
+ * exactly the fields the check reads. Both the resources-layer
+ * `EcsServiceProps` and the patterns-layer `EcsServiceConfig` structurally
+ * satisfy it (typescript-standards § "Helpers consume resolved state, not the
+ * dispatch enum").
+ */
+export interface SharedEc2CapacityServiceInput {
+    name: string;
+    capacityProvider?: EcsCapacityProvider;
+    ec2Config?: Ec2CapacityConfig;
+}
+/**
+ * Cross-service shared-ASG compatibility: groups EC2 services by their
+ * capacity key and rejects a reuse that is incompatible with the ASG's origin
+ * — config drift the shared ASG would silently discard, or a
+ * `persistentDataVolume` singleton being shared. Pure; called from BOTH
+ * validation layers — resources `validateEcsClusterProps` and patterns
+ * `validateEcsProps` (generator-standards § "Validate at the Lowest Layer the
+ * Field Belongs To") — with the same check at the construction site
+ * (`getOrCreateAsgCapacityProvider`) as defence-in-depth.
+ */
+export declare function validateSharedEc2CapacityConfig(services: readonly SharedEc2CapacityServiceInput[]): void;

package/dist/lib/resources/aws/compute/ecsCapacityConfig.js

@@ -0,0 +1,161 @@
+import { AmiHardwareType } from "aws-cdk-lib/aws-ecs";
+import { Token } from "aws-cdk-lib";
+import { DEFAULT_EC2_INSTANCE_TYPE, DEFAULT_EC2_MIN_CAPACITY, DEFAULT_EC2_MAX_CAPACITY, DEFAULT_EC2_INSTANCE_MONITORING, DEFAULT_WARM_POOL_MIN_SIZE, DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN, inferAmiHardwareType } from "./ecsConstants.js";
+/**
+ * Every `Ec2CapacityConfig` field, classified. The `Record<keyof …, …>`
+ * satisfies-shape is a compile-time exhaustiveness guard in compiled `src/`
+ * (typescript-standards § "Compile-time guards must live in compiled src/"):
+ * adding a field to `Ec2CapacityConfig` without classifying it here fails
+ * `tsc`, so a new ASG-shaping field cannot silently join the "not compared,
+ * silently discarded on a shared ASG" bucket.
+ */
+const EC2_CONFIG_FIELD_ROLES = {
+    instanceType: "keyed",
+    amiHardwareType: "keyed",
+    warmPool: "keyed",
+    persistentDataVolume: "keyed",
+    availabilityZones: "keyed",
+    minCapacity: "scalar",
+    maxCapacity: "scalar",
+    desiredCapacity: "scalar",
+    instanceMonitoring: "scalar",
+    associatePublicIpAddress: "scalar",
+    machineImage: "opaque",
+    userData: "opaque",
+    blockDevices: "opaque",
+    tags: "tags",
+    memoryLimitMiB: "taskDefinition"
+};
+function fieldsWithRole(role) {
+    return Object.keys(EC2_CONFIG_FIELD_ROLES).filter((field) => EC2_CONFIG_FIELD_ROLES[field] === role);
+}
+const KEYED_ASG_FIELDS = fieldsWithRole("keyed");
+const SCALAR_ASG_FIELDS = fieldsWithRole("scalar");
+const OPAQUE_ASG_FIELDS = fieldsWithRole("opaque");
+/**
+ * Defaults resolved before a scalar field is compared — the SAME values the
+ * ASG construction applies (`getOrCreateAsgCapacityProvider`), imported from
+ * their `ecsConstants.ts` single source, so an explicit value equal to the
+ * default compares equal to an omitted one instead of tripping the drift
+ * throw on a pair that synthesises identically. Fields with no construction
+ * default (`desiredCapacity`, `associatePublicIpAddress`) compare raw.
+ */
+const SCALAR_ASG_FIELD_DEFAULTS = {
+    minCapacity: DEFAULT_EC2_MIN_CAPACITY,
+    maxCapacity: DEFAULT_EC2_MAX_CAPACITY,
+    instanceMonitoring: DEFAULT_EC2_INSTANCE_MONITORING
+};
+function resolvedScalar(config, field) {
+    return config[field] ?? SCALAR_ASG_FIELD_DEFAULTS[field];
+}
+/** Deep tag-record equality, treating `{}` and absent as the same ASG shape. */
+function tagRecordsEqual(a, b) {
+    const aKeys = a === undefined ? [] : Object.keys(a);
+    const bKeys = b === undefined ? [] : Object.keys(b);
+    if (aKeys.length !== bKeys.length)
+        return false;
+    if (a === undefined || b === undefined)
+        return true;
+    return aKeys.every((key) => Object.is(a[key], b[key]));
+}
+function findDifferingAsgFields(ec2Config, origin) {
+    const differing = SCALAR_ASG_FIELDS.filter((field) => !Object.is(resolvedScalar(ec2Config, field), resolvedScalar(origin, field)));
+    if (!tagRecordsEqual(ec2Config.tags, origin.tags))
+        differing.push("tags");
+    for (const field of OPAQUE_ASG_FIELDS) {
+        if ((ec2Config[field] === undefined) !== (origin[field] === undefined)) {
+            differing.push(field);
+        }
+    }
+    return differing;
+}
+/**
+ * Rejects at synth when a service reusing a shared ASG is incompatible with
+ * it: either the origin's `persistentDataVolume` makes the ASG a singleton
+ * (two tasks would race to attach the same EBS volume), or the reusing
+ * service asks for ASG settings that differ from the ones the ASG was built
+ * with — those settings would be silently ignored (same silent-ignore class
+ * as `validateEc2ServiceSizing`).
+ */
+export function assertSharedAsgConfigMatches(serviceName, ec2Config, key, origin) {
+    // Cross-service only: the construction path legitimately re-resolves the
+    // SAME service's provider (e.g. a second task definition riding its ASG),
+    // and that re-entry must not trip the singleton throw.
+    if (origin.ec2Config.persistentDataVolume !== undefined &&
+        serviceName !== origin.serviceName) {
+        throw new Error(`Service '${serviceName}': its ec2Config resolves to the same EC2 capacity key ('${key}') ` +
+            `as service '${origin.serviceName}', whose persistentDataVolume pairs that auto scaling ` +
+            `group with a single EBS data volume. A persistent-data-volume service is a singleton — ` +
+            `two services sharing its ASG would race to attach the same volume. Change a keyed field ` +
+            `(${KEYED_ASG_FIELDS.map((f) => `'${f}'`).join(", ")}) so this service gets its own ASG.`);
+    }
+    const differing = findDifferingAsgFields(ec2Config, origin.ec2Config);
+    if (differing.length === 0)
+        return;
+    throw new Error(`Service '${serviceName}': ec2Config ${differing.map((f) => `'${f}'`).join(", ")} ` +
+        `${differing.length === 1 ? "is" : "are"} ignored — it shares an auto scaling group with ` +
+        `service '${origin.serviceName}' (both resolve to EC2 capacity key '${key}'), and that ASG ` +
+        `is built from the first service's ec2Config. Either give the two services the same value ` +
+        `for ${differing.map((f) => `'${f}'`).join(", ")}, or give this service its own ASG by ` +
+        `changing a keyed field (${KEYED_ASG_FIELDS.map((f) => `'${f}'`).join(", ")}).`);
+}
+/**
+ * Generates a unique key for EC2 config so services with matching
+ * configurations share an ASG.
+ */
+export function getEc2ConfigKey(ec2Config) {
+    const instanceType = ec2Config.instanceType ?? DEFAULT_EC2_INSTANCE_TYPE;
+    const amiHardwareType = ec2Config.amiHardwareType ??
+        (inferAmiHardwareType(instanceType) === AmiHardwareType.ARM
+            ? "ARM"
+            : "STANDARD");
+    const warmPoolKey = ec2Config.warmPool
+        ? `wp${ec2Config.warmPool.minSize ?? DEFAULT_WARM_POOL_MIN_SIZE}-${ec2Config.warmPool.reuseOnScaleIn ?? DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN}`
+        : "nowp";
+    const baseKey = `${instanceType}-${amiHardwareType}-${warmPoolKey}`;
+    // PDV services are implicit singletons — two identical PDV configs still
+    // collide on this key, so sharing is rejected in assertSharedAsgConfigMatches.
+    const pdv = ec2Config.persistentDataVolume;
+    const extras = [];
+    if (pdv !== undefined) {
+        extras.push(`pdv-${pdv.deviceName}-${pdv.sizeGb}-${stableAzSegment(pdv.availabilityZone)}`);
+    }
+    // Serialise actual AZ names — `az${length}` would let services pinned to different AZs collide on `az1`.
+    // CDK Tokens (env-agnostic stacks) substitute a stable sentinel to keep logical IDs deterministic.
+    if (ec2Config.availabilityZones !== undefined) {
+        const azKey = [...ec2Config.availabilityZones]
+            .map(stableAzSegment)
+            .sort()
+            .join(",");
+        extras.push(`az-${azKey}`);
+    }
+    return extras.length === 0 ? baseKey : `${baseKey}-${extras.join("-")}`;
+}
+function stableAzSegment(az) {
+    return Token.isUnresolved(az) ? "synthAz" : az;
+}
+/**
+ * Cross-service shared-ASG compatibility: groups EC2 services by their
+ * capacity key and rejects a reuse that is incompatible with the ASG's origin
+ * — config drift the shared ASG would silently discard, or a
+ * `persistentDataVolume` singleton being shared. Pure; called from BOTH
+ * validation layers — resources `validateEcsClusterProps` and patterns
+ * `validateEcsProps` (generator-standards § "Validate at the Lowest Layer the
+ * Field Belongs To") — with the same check at the construction site
+ * (`getOrCreateAsgCapacityProvider`) as defence-in-depth.
+ */
+export function validateSharedEc2CapacityConfig(services) {
+    const origins = new Map();
+    for (const service of services) {
+        if (service.capacityProvider !== "EC2")
+            continue;
+        const ec2Config = service.ec2Config ?? {};
+        const key = getEc2ConfigKey(ec2Config);
+        const origin = origins.get(key);
+        if (origin === undefined) {
+            origins.set(key, { serviceName: service.name, ec2Config });
+            continue;
+        }
+        assertSharedAsgConfigMatches(service.name, ec2Config, key, origin);
+    }
+}

package/dist/lib/resources/aws/compute/ecsConstants.d.ts

@@ -1,3 +1,4 @@
+import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { AmiHardwareType } from "aws-cdk-lib/aws-ecs";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 export declare const DEFAULT_EC2_INSTANCE_TYPE = "t4g.micro";
@@ -8,6 +9,9 @@ export declare const DEFAULT_LOG_RETENTION = RetentionDays.TWO_WEEKS;
 export declare const DEFAULT_FARGATE_CPU = 256;
 export declare const DEFAULT_FARGATE_MEMORY_MIB = 512;
 export declare const DEFAULT_EC2_CONTAINER_MEMORY_MIB = 1024;
+export declare const DEFAULT_EC2_MIN_CAPACITY = 2;
+export declare const DEFAULT_EC2_MAX_CAPACITY = 3;
+export declare const DEFAULT_EC2_INSTANCE_MONITORING = Monitoring.BASIC;
 /**
  * The container hard memory limit for an EC2-capacity ECS service.
  *

package/dist/lib/resources/aws/compute/ecsConstants.js

@@ -1,3 +1,4 @@
+import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { AmiHardwareType } from "aws-cdk-lib/aws-ecs";
 import { RetentionDays } from "aws-cdk-lib/aws-logs";
 // Canonical source: @fjall/generator schemas/constants.ts — keep in sync
@@ -16,6 +17,14 @@ export const DEFAULT_LOG_RETENTION = RetentionDays.TWO_WEEKS;
 export const DEFAULT_FARGATE_CPU = 256;
 export const DEFAULT_FARGATE_MEMORY_MIB = 512;
 export const DEFAULT_EC2_CONTAINER_MEMORY_MIB = 1024;
+// Read at two sites that must agree (code-quality § coupled values): the ASG
+// construction (`getOrCreateAsgCapacityProvider`) and the shared-ASG drift
+// compare (`ecsCapacityConfig.ts` SCALAR_ASG_FIELD_DEFAULTS) — the compare
+// resolves the same defaults the construction applies, or an explicit value
+// equal to the default would read as drift.
+export const DEFAULT_EC2_MIN_CAPACITY = 2;
+export const DEFAULT_EC2_MAX_CAPACITY = 3;
+export const DEFAULT_EC2_INSTANCE_MONITORING = Monitoring.BASIC;
 /**
  * The container hard memory limit for an EC2-capacity ECS service.
  *

package/dist/lib/resources/aws/compute/ecsLifecycleHookMigration.js

@@ -49,7 +49,7 @@ export class EcsLifecycleHookMigration extends Construct {
                 : "DISABLED"
         };
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: `${id} ECS deployment lifecycle hook for migration`,

package/dist/lib/resources/aws/compute/ecsServiceFactory.d.ts

@@ -3,7 +3,8 @@ import type { FargateTaskDefinition, Ec2TaskDefinition } from "aws-cdk-lib/aws-e
 import { type ISecurityGroup } from "aws-cdk-lib/aws-ec2";
 import { TargetTrackingScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
 import { type AutoScalingGroup } from "aws-cdk-lib/aws-autoscaling";
-import { type EcsServiceProps, type Ec2CapacityConfig, type QueueScalingResources } from "./ecsTypes.js";
+import { type Ec2AsgOrigin } from "./ecsCapacityConfig.js";
+import { type EcsServiceProps, type QueueScalingResources } from "./ecsTypes.js";
 import type { EcsConstructContext } from "./ecsContext.js";
 /**
  * Resolves the user's `circuitBreaker` config to the CDK
@@ -22,18 +23,11 @@ export interface AsgCapacityState {
      * service sharing the key can be checked against it
      * ({@link assertSharedAsgConfigMatches}).
      */
-    asgOrigins: Map<string, {
-        serviceName: string;
-        ec2Config: Ec2CapacityConfig;
-    }>;
+    asgOrigins: Map<string, Ec2AsgOrigin>;
     autoScalingGroup?: AutoScalingGroup;
     asgSecurityGroup?: ISecurityGroup;
 }
-/**
- * Generates a unique key for EC2 config so services with matching
- * configurations share an ASG.
- */
-export declare function getEc2ConfigKey(ec2Config: Ec2CapacityConfig): string;
+export { getEc2ConfigKey, validateSharedEc2CapacityConfig, type Ec2AsgOrigin, type SharedEc2CapacityServiceInput } from "./ecsCapacityConfig.js";
 /**
  * Gets or creates an ASG capacity provider for an EC2-backed service.
  * Services with matching EC2 configs share the same ASG.

package/dist/lib/resources/aws/compute/ecsServiceFactory.js

@@ -2,16 +2,16 @@ import { FargateService, Ec2Service, PropagatedTagSource, PlacementStrategy, Asg
 import { Peer, Port, SubnetType, UserData } from "aws-cdk-lib/aws-ec2";
 import { ServicePrincipal } from "aws-cdk-lib/aws-iam";
 import { Role } from "../iam/role.js";
-import { CfnOutput, Duration, Token } from "aws-cdk-lib";
+import { CfnOutput, Duration } from "aws-cdk-lib";
 import { AdjustmentType, PredefinedMetric, ScalableTarget, ServiceNamespace, StepScalingAction, TargetTrackingScalingPolicy } from "aws-cdk-lib/aws-applicationautoscaling";
 import { Alarm, ComparisonOperator, MathExpression } from "aws-cdk-lib/aws-cloudwatch";
 import { ApplicationScalingAction } from "aws-cdk-lib/aws-cloudwatch-actions";
-import { Monitoring } from "aws-cdk-lib/aws-autoscaling";
 import { SecurityGroup } from "../networking/securityGroup.js";
 import { Ec2Instance } from "./ec2.js";
 import { vpcHasNatGateways } from "../../../utils/vpcUtils.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
-import { DEFAULT_EC2_INSTANCE_TYPE, DEFAULT_WARM_POOL_MIN_SIZE, DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN, DEFAULT_HEALTH_CHECK_GRACE_SECONDS, DEFAULT_MIN_HEALTHY_PERCENT, DEFAULT_MAX_HEALTHY_PERCENT, DEFAULT_DESIRED_COUNT, inferAmiHardwareType } from "./ecsConstants.js";
+import { DEFAULT_EC2_INSTANCE_TYPE, DEFAULT_EC2_MIN_CAPACITY, DEFAULT_EC2_MAX_CAPACITY, DEFAULT_EC2_INSTANCE_MONITORING, DEFAULT_WARM_POOL_MIN_SIZE, DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN, DEFAULT_HEALTH_CHECK_GRACE_SECONDS, DEFAULT_MIN_HEALTHY_PERCENT, DEFAULT_MAX_HEALTHY_PERCENT, DEFAULT_DESIRED_COUNT, inferAmiHardwareType } from "./ecsConstants.js";
+import { assertSharedAsgConfigMatches, getEc2ConfigKey } from "./ecsCapacityConfig.js";
 import { ScalingType } from "./ecsTypes.js";
 import { isServiceFargate, isServiceEc2 } from "./ecsTaskDefinition.js";
 /**
@@ -26,101 +26,7 @@ export function resolveCircuitBreaker(config) {
     const rollback = config?.rollback ?? true;
     return { enable: true, rollback };
 }
-/**
- * `ec2Config` fields that shape the ASG but are NOT part of
- * {@link getEc2ConfigKey}, split by how a difference can be detected without
- * false positives. A second service whose key matches reuses the first
- * service's ASG, so any of these it sets is silently discarded.
- *
- * Scalars compare by value. `tags` is plain data, so it compares deeply.
- * `machineImage` / `userData` / `blockDevices` are CDK objects with no stable
- * structural identity — two equivalent literals are different references, so
- * only a defined-vs-undefined asymmetry is safe to report. They deliberately
- * under-report: over-reporting is a hard synth failure on config that
- * previously worked, which is the more damaging direction.
- */
-const SCALAR_ASG_FIELDS = [
-    "minCapacity",
-    "maxCapacity",
-    "desiredCapacity",
-    "instanceMonitoring",
-    "associatePublicIpAddress"
-];
-const OPAQUE_ASG_FIELDS = [
-    "machineImage",
-    "userData",
-    "blockDevices"
-];
-function tagRecordsEqual(a, b) {
-    if (a === undefined || b === undefined)
-        return a === b;
-    const aKeys = Object.keys(a);
-    if (aKeys.length !== Object.keys(b).length)
-        return false;
-    return aKeys.every((key) => Object.is(a[key], b[key]));
-}
-function findDifferingAsgFields(ec2Config, origin) {
-    const differing = SCALAR_ASG_FIELDS.filter((field) => !Object.is(ec2Config[field], origin[field]));
-    if (!tagRecordsEqual(ec2Config.tags, origin.tags))
-        differing.push("tags");
-    for (const field of OPAQUE_ASG_FIELDS) {
-        if ((ec2Config[field] === undefined) !== (origin[field] === undefined)) {
-            differing.push(field);
-        }
-    }
-    return differing;
-}
-/**
- * Rejects at synth when a service reusing a shared ASG asks for ASG settings
- * that differ from the ones the ASG was built with — those settings would be
- * silently ignored (same silent-ignore class as `validateEc2ServiceSizing`).
- */
-function assertSharedAsgConfigMatches(serviceName, ec2Config, key, origin) {
-    const differing = findDifferingAsgFields(ec2Config, origin.ec2Config);
-    if (differing.length === 0)
-        return;
-    throw new Error(`Service '${serviceName}': ec2Config ${differing.map((f) => `'${f}'`).join(", ")} ` +
-        `${differing.length === 1 ? "is" : "are"} ignored — it shares an auto scaling group with ` +
-        `service '${origin.serviceName}' (both resolve to EC2 capacity key '${key}'), and that ASG ` +
-        `is built from the first service's ec2Config. Either give the two services the same value ` +
-        `for ${differing.map((f) => `'${f}'`).join(", ")}, or give this service its own ASG by ` +
-        `changing a keyed field ('instanceType', 'amiHardwareType', 'warmPool', ` +
-        `'persistentDataVolume', 'availabilityZones').`);
-}
-/**
- * Generates a unique key for EC2 config so services with matching
- * configurations share an ASG.
- */
-export function getEc2ConfigKey(ec2Config) {
-    const instanceType = ec2Config.instanceType ?? DEFAULT_EC2_INSTANCE_TYPE;
-    const amiHardwareType = ec2Config.amiHardwareType ??
-        (inferAmiHardwareType(instanceType) === AmiHardwareType.ARM
-            ? "ARM"
-            : "STANDARD");
-    const warmPoolKey = ec2Config.warmPool
-        ? `wp${ec2Config.warmPool.minSize ?? DEFAULT_WARM_POOL_MIN_SIZE}-${ec2Config.warmPool.reuseOnScaleIn ?? DEFAULT_WARM_POOL_REUSE_ON_SCALE_IN}`
-        : "nowp";
-    const baseKey = `${instanceType}-${amiHardwareType}-${warmPoolKey}`;
-    // PDV services are implicit singletons — sharing an ASG would let two tasks race for the same EBS volume.
-    const pdv = ec2Config.persistentDataVolume;
-    const extras = [];
-    if (pdv !== undefined) {
-        extras.push(`pdv-${pdv.deviceName}-${pdv.sizeGb}-${stableAzSegment(pdv.availabilityZone)}`);
-    }
-    // Serialise actual AZ names — `az${length}` would let services pinned to different AZs collide on `az1`.
-    // CDK Tokens (env-agnostic stacks) substitute a stable sentinel to keep logical IDs deterministic.
-    if (ec2Config.availabilityZones !== undefined) {
-        const azKey = [...ec2Config.availabilityZones]
-            .map(stableAzSegment)
-            .sort()
-            .join(",");
-        extras.push(`az-${azKey}`);
-    }
-    return extras.length === 0 ? baseKey : `${baseKey}-${extras.join("-")}`;
-}
-function stableAzSegment(az) {
-    return Token.isUnresolved(az) ? "synthAz" : az;
-}
+export { getEc2ConfigKey, validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
 /**
  * Gets or creates an ASG capacity provider for an EC2-backed service.
  * Services with matching EC2 configs share the same ASG.
@@ -146,8 +52,8 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
             ? AmiHardwareType.STANDARD
             : AmiHardwareType.ARM
         : inferAmiHardwareType(instanceType);
-    const minCapacity = ec2Config.minCapacity ?? 2;
-    const maxCapacity = ec2Config.maxCapacity ?? 3;
+    const minCapacity = ec2Config.minCapacity ?? DEFAULT_EC2_MIN_CAPACITY;
+    const maxCapacity = ec2Config.maxCapacity ?? DEFAULT_EC2_MAX_CAPACITY;
     const asgSecurityGroup = ctx.props.cluster?.securityGroup ??
         new SecurityGroup(ctx.scope, `${safeKey}AsgSecurityGroup`, {
             vpc: ctx.cluster.vpc,
@@ -195,7 +101,7 @@ export function getOrCreateAsgCapacityProvider(ctx, serviceProps, state) {
             EcsOptimizedImage.amazonLinux2023(amiHardwareType),
         userData: ec2Config.userData ?? UserData.forLinux(),
         role: instanceRole,
-        instanceMonitoring: ec2Config.instanceMonitoring ?? Monitoring.BASIC,
+        instanceMonitoring: ec2Config.instanceMonitoring ?? DEFAULT_EC2_INSTANCE_MONITORING,
         capacityRebalance: true,
         ecsClusterArn: ctx.cluster.clusterArn,
         ...(ec2Config.desiredCapacity !== undefined && {

package/dist/lib/resources/aws/compute/ecsValidation.js

@@ -3,6 +3,7 @@ import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab, SSM_COMPONENT_PATTERN, SSM_COMPONENT_ERROR, SECRET_NAME_PATTERN, SECRET_NAME_ERROR } from "@fjall/util";
 import { ScalingType } from "./ecsTypes.js";
 import { DEFAULT_EC2_CONTAINER_MEMORY_MIB } from "./ecsConstants.js";
+import { validateSharedEc2CapacityConfig } from "./ecsCapacityConfig.js";
 /**
  * Validates ECS cluster props before construction.
  * Pure function — does not depend on class state.
@@ -196,6 +197,11 @@ export function validateEcsClusterProps(props) {
             }
         }
     }
+    // Cross-service, so it runs after the per-service loop: EC2 services whose
+    // ec2Config resolves to the same capacity key share one ASG — reject config
+    // drift the shared ASG would silently discard, and any sharing of a
+    // persistentDataVolume (singleton) ASG.
+    validateSharedEc2CapacityConfig(props.services);
 }
 /**
  * Rejects service-level task sizing that is silently ignored for EC2 capacity.

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -157,7 +157,7 @@ export class PersistentDataVolume extends Construct {
             resources: [asgArnWildcard]
         });
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: `${id} ${PERSISTENT_DATA_VOLUME_LAUNCHING_DESCRIPTION}`,

package/dist/lib/resources/aws/database/rdsInstance.js

@@ -252,7 +252,7 @@ export class RdsInstance extends Construct {
         const instanceId = ResourceNaming.dbInstanceId(this.constructId);
         const waiterTimeout = Duration.minutes(10);
         const deletionWaiter = new CustomResource(this, `${this.databaseNameValue}DeletionWaiter`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: waiterTimeout.plus(Duration.seconds(30)),
             lambdaDescription: `${this.databaseNameValue} deletion waiter`,
             inlineCode: `

package/dist/lib/resources/aws/iam/identityCenter/user.js

@@ -33,7 +33,7 @@ export class IdentityStoreUserProvider extends Construct {
         const identityStoreArn = `arn:${stack.partition}:identitystore::${stack.account}:identitystore/${props.identityStoreId}`;
         const userArnPattern = identityStoreUserArnPattern(stack.partition);
         const handler = new SingletonFunction(this, "Handler", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             code: Code.fromAsset(LAMBDA_ASSET_DIR),
             handler: "index.handler",
             timeout: HANDLER_TIMEOUT_SECONDS,

package/dist/lib/resources/aws/networking/crossAccountReturnRoutes.js

@@ -21,7 +21,7 @@ export class CrossAccountReturnRoutes extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         this.customResource = new CustomResource(this, "Handler", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: `${id} cross-account return-route manager`,
             roleDescription: `${id} return-route Lambda execution role`,

package/dist/lib/resources/aws/networking/ipamPool.js

@@ -166,7 +166,7 @@ export class IpamPool extends Construct {
                 // On stack deletion, VPC allocations (not managed by CloudFormation)
                 // block CIDR deprovisioning. This custom resource releases them first.
                 const allocationCleanup = new CustomResource(this, `${constructKey}IpamCleanup${regionSuffix}`, {
-                    runtime: Runtime.NODEJS_22_X,
+                    runtime: Runtime.NODEJS_24_X,
                     timeout: Duration.minutes(5),
                     lambdaDescription: `${account} IPAM pool allocation cleanup - ${region}`,
                     properties: {

package/dist/lib/resources/aws/organisation/costAllocationTagActivator.js

@@ -36,7 +36,7 @@ export class CostAllocationTagActivator extends Construct {
         this.lambda = new LambdaFunction(this, "TagActivatorFunction", {
             // Referenced cross-environment by the App messaging stack's schedule rule.
             functionName: PhysicalName.GENERATE_IF_NEEDED,
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(HANDLER_CODE),
             lambdaDescription: "Auto-discovers and activates cost allocation tags in Cost Explorer",

package/dist/lib/resources/aws/utilities/tlsCertGenerator.js

@@ -66,7 +66,7 @@ export class TlsCertGenerator extends Construct {
             resources: [caCmk.key.keyArn, serverCmk.key.keyArn]
         });
         const cr = new CustomResource(this, "Generator", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: LAMBDA_TIMEOUT,
             codePath: LAMBDA_ASSET_DIR,
             handler: "index.handler",

package/dist/lib/utils/engineCompat.d.ts

@@ -1,11 +1,18 @@
 import { type EngineCompat } from "@fjall/util/manifest/schemas";
 /**
  * Normalise an npm dependency RANGE to its minimum X.Y.Z floor: strip a leading
- * range operator (`^`, `~`, `>=`, `>`, `=`, `v`) and any prerelease/build
- * metadata, then reconstruct `${major}.${minor}.${patch}` (missing minor/patch
- * default to 0). Returns undefined for anything without a valid integer major —
- * so a non-semver range (a git URL, `*`) yields no floor and the caller omits
- * the field rather than emitting garbage.
+ * inclusive range operator (`^`, `~`, `>=`, `=`, `v`), then reconstruct
+ * `${major}.${minor}.${patch}` (missing minor/patch default to 0).
+ *
+ * Deliberately conservative — returns undefined (→ the caller omits the field,
+ * FM1 degrades to no-op) for every shape whose true floor the first-token strip
+ * would MIS-state rather than merely fail to state:
+ *   - unions (`^3 || ^2` floors at 2.0.0, not the first branch's 3.0.0)
+ *   - strict lower bounds (`>2.1134.0` excludes its own literal)
+ *   - prerelease bounds (`^2.0.0-rc.1` floors below the stripped 2.0.0)
+ *   - non-decimal segments (`1e2`, hex, `2.x`, `*`, git URLs, 4+ segments)
+ * A wrong floor is worse than no floor: over-strict refuses a valid engine,
+ * under-strict admits an incompatible one — both silently.
  */
 export declare function rangeFloor(range: string | undefined): string | undefined;
 /**

package/dist/lib/utils/engineCompat.js

@@ -56,29 +56,39 @@ import { FjallLogger } from "./validationLogger.js";
 const PACKAGE_NAME = "@fjall/components-infrastructure";
 /**
  * Normalise an npm dependency RANGE to its minimum X.Y.Z floor: strip a leading
- * range operator (`^`, `~`, `>=`, `>`, `=`, `v`) and any prerelease/build
- * metadata, then reconstruct `${major}.${minor}.${patch}` (missing minor/patch
- * default to 0). Returns undefined for anything without a valid integer major —
- * so a non-semver range (a git URL, `*`) yields no floor and the caller omits
- * the field rather than emitting garbage.
+ * inclusive range operator (`^`, `~`, `>=`, `=`, `v`), then reconstruct
+ * `${major}.${minor}.${patch}` (missing minor/patch default to 0).
+ *
+ * Deliberately conservative — returns undefined (→ the caller omits the field,
+ * FM1 degrades to no-op) for every shape whose true floor the first-token strip
+ * would MIS-state rather than merely fail to state:
+ *   - unions (`^3 || ^2` floors at 2.0.0, not the first branch's 3.0.0)
+ *   - strict lower bounds (`>2.1134.0` excludes its own literal)
+ *   - prerelease bounds (`^2.0.0-rc.1` floors below the stripped 2.0.0)
+ *   - non-decimal segments (`1e2`, hex, `2.x`, `*`, git URLs, 4+ segments)
+ * A wrong floor is worse than no floor: over-strict refuses a valid engine,
+ * under-strict admits an incompatible one — both silently.
  */
 export function rangeFloor(range) {
     if (range === undefined || range.length === 0)
         return undefined;
-    const firstToken = range.trim().split(/\s+/)[0] ?? "";
-    const core = firstToken.replace(/^[\^~>=v ]+/i, "").split(/[-+]/)[0] ?? "";
-    if (core.length === 0)
+    const trimmed = range.trim();
+    if (trimmed.includes("||"))
+        return undefined;
+    const firstToken = trimmed.split(/\s+/)[0] ?? "";
+    if (/^>(?!=)/.test(firstToken))
+        return undefined;
+    const core = firstToken.replace(/^[\^~>=v ]+/i, "");
+    if (/[-+]/.test(core))
         return undefined;
     const parts = core.split(".");
+    if (parts.length === 0 || parts.length > 3)
+        return undefined;
+    if (!parts.every((segment) => /^\d+$/.test(segment)))
+        return undefined;
     const major = Number(parts[0]);
     const minor = parts.length > 1 ? Number(parts[1]) : 0;
     const patch = parts.length > 2 ? Number(parts[2]) : 0;
-    if (!Number.isInteger(major) || major < 0)
-        return undefined;
-    if (!Number.isInteger(minor) || minor < 0)
-        return undefined;
-    if (!Number.isInteger(patch) || patch < 0)
-        return undefined;
     return `${major}.${minor}.${patch}`;
 }
 /**
@@ -100,12 +110,20 @@ function resolveConstructsPackageMeta() {
                     typeof pkg.version === "string" &&
                     pkg.version.length > 0) {
                     const awsCdkPeer = pkg.peerDependencies?.["aws-cdk"];
-                    return {
-                        version: pkg.version,
-                        awsCdkCliFloor: typeof awsCdkPeer === "string"
-                            ? rangeFloor(awsCdkPeer)
-                            : undefined
-                    };
+                    const awsCdkCliFloor = typeof awsCdkPeer === "string" ? rangeFloor(awsCdkPeer) : undefined;
+                    if (awsCdkCliFloor === undefined) {
+                        // The FM1 omission is fail-safe but must never be silent — an
+                        // assembly without minimumAwsCdkCli skips the deploy engine's
+                        // CLI-floor check entirely.
+                        FjallLogger.warn(typeof awsCdkPeer === "string"
+                            ? `engineCompat: aws-cdk peer range "${awsCdkPeer}" has no ` +
+                                `derivable minimum floor — minimumAwsCdkCli will be ` +
+                                `omitted and the deploy engine's CLI-floor check skipped`
+                            : "engineCompat: no aws-cdk peerDependency found — " +
+                                "minimumAwsCdkCli will be omitted and the deploy " +
+                                "engine's CLI-floor check skipped");
+                    }
+                    return { version: pkg.version, awsCdkCliFloor };
                 }
             }
             if (dir === root)
@@ -150,9 +168,10 @@ export const AWS_CDK_CLI_FLOOR = CONSTRUCTS_PACKAGE_META?.awsCdkCliFloor;
 export function buildEngineCompatFrom(version, awsCdkCliFloor) {
     if (version === undefined || version.length === 0)
         return undefined;
-    const major = Number(version.split(".")[0]);
-    if (!Number.isInteger(major) || major < 0)
+    const majorToken = version.split(".")[0] ?? "";
+    if (!/^\d+$/.test(majorToken))
         return undefined;
+    const major = Number(majorToken);
     return {
         synthesisedBy: version,
         minimumEngineVersion: `${major}.0.0`,

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "5.0.0",
+  "version": "6.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fjall-tech/fjall.git",
+    "directory": "components/infrastructure"
+  },
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -69,8 +74,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^5.0.0",
-    "@fjall/util": "^5.0.0",
+    "@fjall/generator": "^6.0.0",
+    "@fjall/util": "^6.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {
@@ -78,11 +83,11 @@
   },
   "peerDependencies": {
     "aws-cdk": "^2.1134.0",
-    "aws-cdk-lib": "^2.262.2",
+    "aws-cdk-lib": "^2.263.0",
     "constructs": "^10.7.2"
   },
   "engines": {
     "node": ">=18.0.0"
   },
-  "gitHead": "78dded6f582368076e8b5f351399219e5a954659"
+  "gitHead": "7620fc7c93bbef1046580d6568546afe3cd450a7"
 }