@fjall/components-infrastructure 5.0.0 → 7.0.0

package/dist/lib/config/aws/ebsDefaultEncryption.js

@@ -11,7 +11,7 @@ export class EbsDefaultEncryption extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "EbsDefaultEncryption", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables EBS default encryption at account level",
             inlinePolicy: [

package/dist/lib/config/aws/inspectorEnablement.js

@@ -12,7 +12,7 @@ export class InspectorEnablement extends Construct {
     constructor(scope, id) {
         super(scope, id);
         new CustomResource(this, "InspectorEnable", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Enables/disables Inspector v2 for the account",
             inlinePolicy: [

package/dist/lib/config/aws/oidcConnector.js

@@ -74,7 +74,7 @@ export class OidcConnector extends Construct {
         const issuerDomain = FJALL_OIDC_ISSUER_DOMAIN;
         const issuerUrl = `https://${issuerDomain}`;
         const providerResource = new CustomResource(this, "OidcProvider", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Adopt-or-create the account-global Fjall OIDC provider",
             resourceType: "Custom::FjallOidcProvider",

package/dist/lib/config/aws/s3BlockPublicAccess.js

@@ -25,7 +25,7 @@ export class S3BlockPublicAccess extends Construct {
         const account = getConfig().providerAccounts.find((pa) => pa.id === props.accountId);
         const enforce = (account?.s3BlockPublicAccess ?? "off") === "enforced";
         new CustomResource(this, "S3BlockPublicAccess", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Manages S3 Block Public Access at account level",
             rolePath: "/fjall/",

package/dist/lib/config/aws/securityServicesAdmin.js

@@ -35,7 +35,7 @@ export class SecurityServicesAdmin extends Construct {
     }
     createGuardDutyAdmin() {
         new CustomResource(this, "GuardDutyOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures GuardDuty organisation-wide auto-enablement",
             inlinePolicy: [
@@ -70,7 +70,7 @@ exports.handler = async (event) => {
     }
     createSecurityHubAdmin() {
         new CustomResource(this, "SecurityHubOrgConfig", {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             timeout: Duration.minutes(5),
             lambdaDescription: "Configures SecurityHub organisation-wide auto-enablement",
             inlinePolicy: [

package/dist/lib/lambda-assets/cert-generator/asset/index.js

@@ -6549,15 +6549,15 @@ var require_parser = __commonJS({
     var helper_1 = require_helper();
     var storage_1 = require_storage();
     var AsnParser = class {
-      static parse(data, target) {
-        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data));
+      static parse(data, target, options) {
+        const asn1Parsed = asn1js.fromBER((0, bytes_1.toArrayBuffer)(data), options?.berOptions);
         if (asn1Parsed.result.error) {
           throw new Error(asn1Parsed.result.error);
         }
-        const res = this.fromASN(asn1Parsed.result, target);
+        const res = this.fromASN(asn1Parsed.result, target, options);
         return res;
       }
-      static fromASN(asn1Schema, target) {
+      static fromASN(asn1Schema, target, options) {
         try {
           if ((0, helper_1.isConvertible)(target)) {
             const value = new target();
@@ -6566,7 +6566,7 @@ var require_parser = __commonJS({
           const schema = storage_1.schemaStorage.get(target);
           storage_1.schemaStorage.cache(target);
           let targetSchema = schema.schema;
-          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema);
+          const choiceResult = this.handleChoiceTypes(asn1Schema, schema, target, targetSchema, options);
           if (choiceResult?.result) {
             return choiceResult.result;
           }
@@ -6576,9 +6576,9 @@ var require_parser = __commonJS({
           const sequenceResult = this.handleSequenceTypes(asn1Schema, schema, target, targetSchema);
           const res = new target();
           if ((0, helper_1.isTypeOfArray)(target)) {
-            return this.handleArrayTypes(asn1Schema, schema, target);
+            return this.handleArrayTypes(asn1Schema, schema, target, options);
           }
-          this.processSchemaItems(schema, sequenceResult, res);
+          this.processSchemaItems(schema, sequenceResult, res, options);
           return res;
         } catch (error) {
           if (error instanceof errors_1.AsnSchemaValidationError) {
@@ -6587,7 +6587,7 @@ var require_parser = __commonJS({
           throw error;
         }
       }
-      static handleChoiceTypes(asn1Schema, schema, target, targetSchema) {
+      static handleChoiceTypes(asn1Schema, schema, target, targetSchema, options) {
         if (asn1Schema.constructor === asn1js.Constructed && schema.type === enums_1.AsnTypeTypes.Choice && asn1Schema.idBlock.tagClass === 3) {
           for (const key in schema.items) {
             const schemaItem = schema.items[key];
@@ -6598,7 +6598,7 @@ var require_parser = __commonJS({
                   const newSeq = new asn1js.Sequence();
                   if ("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value) && "value" in newSeq.valueBlock) {
                     newSeq.valueBlock.value = asn1Schema.valueBlock.value;
-                    const fieldValue = this.fromASN(newSeq, schemaItem.type);
+                    const fieldValue = this.fromASN(newSeq, schemaItem.type, options);
                     const res = new target();
                     res[key] = fieldValue;
                     return { result: res };
@@ -6689,7 +6689,7 @@ var require_parser = __commonJS({
           throw err;
         }
       }
-      static handleArrayTypes(asn1Schema, schema, target) {
+      static handleArrayTypes(asn1Schema, schema, target, options) {
         if (!("value" in asn1Schema.valueBlock && Array.isArray(asn1Schema.valueBlock.value))) {
           throw new Error("Cannot get items from the ASN.1 parsed value. ASN.1 object is not constructed.");
         }
@@ -6701,10 +6701,10 @@ var require_parser = __commonJS({
           }
           return target.from(asn1Schema.valueBlock.value, (element) => converter.fromASN(element));
         } else {
-          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType));
+          return target.from(asn1Schema.valueBlock.value, (element) => this.fromASN(element, itemType, options));
         }
       }
-      static processSchemaItems(schema, asn1ComparedSchema, res) {
+      static processSchemaItems(schema, asn1ComparedSchema, res, options) {
         for (const key in schema.items) {
           const asn1SchemaValue = asn1ComparedSchema.result[key];
           if (!asn1SchemaValue) {
@@ -6714,9 +6714,9 @@ var require_parser = __commonJS({
           const schemaItemType = schemaItem.type;
           let parsedValue;
           if (typeof schemaItemType === "number" || (0, helper_1.isConvertible)(schemaItemType)) {
-            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           } else {
-            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType);
+            parsedValue = this.processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options);
           }
           if (parsedValue && typeof parsedValue === "object" && "value" in parsedValue && "raw" in parsedValue) {
             res[key] = parsedValue.value;
@@ -6726,23 +6726,23 @@ var require_parser = __commonJS({
           }
         }
       }
-      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processPrimitiveSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         const converter = schemaItem.converter ?? ((0, helper_1.isConvertible)(schemaItemType) ? new schemaItemType() : null);
         if (!converter) {
           throw new Error("Converter is empty");
         }
         if (schemaItem.repeated) {
-          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter);
+          return this.processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options);
         } else {
-          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter);
+          return this.processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options);
         }
       }
-      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter) {
+      static processRepeatedPrimitiveItem(asn1SchemaValue, schemaItem, converter, options) {
         if (schemaItem.implicit) {
           const Container = schemaItem.repeated === "sequence" ? asn1js.Sequence : asn1js.Set;
           const newItem = new Container();
           newItem.valueBlock = asn1SchemaValue.valueBlock;
-          const newItemAsn = asn1js.fromBER(newItem.toBER(false));
+          const newItemAsn = asn1js.fromBER(newItem.toBER(false), options?.berOptions);
           if (newItemAsn.offset === -1) {
             throw new Error(`Cannot parse the child item. ${newItemAsn.result.error}`);
           }
@@ -6755,7 +6755,7 @@ var require_parser = __commonJS({
           return Array.from(asn1SchemaValue, (element) => converter.fromASN(element));
         }
       }
-      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter) {
+      static processSinglePrimitiveItem(asn1SchemaValue, schemaItem, schemaItemType, converter, options) {
         let value = asn1SchemaValue;
         if (schemaItem.implicit) {
           let newItem;
@@ -6770,21 +6770,21 @@ var require_parser = __commonJS({
             newItem = new Asn1Type();
           }
           newItem.valueBlock = value.valueBlock;
-          value = asn1js.fromBER(newItem.toBER(false)).result;
+          value = asn1js.fromBER(newItem.toBER(false), options?.berOptions).result;
         }
         return converter.fromASN(value);
       }
-      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType) {
+      static processComplexSchemaItem(asn1SchemaValue, schemaItem, schemaItemType, options) {
         if (schemaItem.repeated) {
           if (!Array.isArray(asn1SchemaValue)) {
             throw new Error("Cannot get list of items from the ASN.1 parsed value. ASN.1 value should be iterable.");
           }
-          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType));
+          return Array.from(asn1SchemaValue, (element) => this.fromASN(element, schemaItemType, options));
         } else {
           const valueToProcess = this.handleImplicitTagging(asn1SchemaValue, schemaItem, schemaItemType);
           if (this.isOptionalChoiceField(schemaItem)) {
             try {
-              return this.fromASN(valueToProcess, schemaItemType);
+              return this.fromASN(valueToProcess, schemaItemType, options);
             } catch (err) {
               if (err instanceof errors_1.AsnSchemaValidationError && /Wrong values for Choice type/.test(err.message)) {
                 return void 0;
@@ -6792,7 +6792,7 @@ var require_parser = __commonJS({
               throw err;
             }
           } else {
-            const parsedValue = this.fromASN(valueToProcess, schemaItemType);
+            const parsedValue = this.fromASN(valueToProcess, schemaItemType, options);
             if (schemaItem.raw) {
               return {
                 value: parsedValue,
@@ -7009,12 +7009,12 @@ var require_convert = __commonJS({
       static serialize(obj) {
         return serializer_1.AsnSerializer.serialize(obj);
       }
-      static parse(data, target) {
-        return parser_1.AsnParser.parse(data, target);
+      static parse(data, target, options) {
+        return parser_1.AsnParser.parse(data, target, options);
       }
-      static toString(data) {
+      static toString(data, options) {
         const buf = (0, bytes_1.isBufferSource)(data) ? (0, bytes_1.toArrayBuffer)(data) : _AsnConvert.serialize(data);
-        const asn = asn1js.fromBER(buf);
+        const asn = asn1js.fromBER(buf, options?.berOptions);
         if (asn.offset === -1) {
           throw new Error(`Cannot decode ASN.1 data. ${asn.result.error}`);
         }
@@ -14678,9 +14678,9 @@ var require_cjs11 = __commonJS({
   }
 });
 
-// node_modules/@peculiar/x509/build/x509.cjs.js
+// ../../node_modules/@peculiar/x509/build/x509.cjs.js
 var require_x509_cjs = __commonJS({
-  "node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
+  "../../node_modules/@peculiar/x509/build/x509.cjs.js"(exports2) {
     "use strict";
     var asn1Schema = require_cjs();
     var asn1X509 = require_cjs2();

package/dist/lib/patterns/aws/clickhouseDatabase.js

@@ -389,6 +389,10 @@ export class ClickHouseDatabase extends Construct {
                     securityGroups: [securityGroup],
                     deployment: { minHealthyPercent: 0, maxHealthyPercent: 100 },
                     ec2Config: {
+                        // Pattern-chosen stable slot: the composed cluster must never
+                        // collide with the app's own EC2 compute defaulting "primary"
+                        // (slots are app-scoped; collision is a hard synth error).
+                        slot: "clickhouse",
                         instanceType,
                         machineImage: EcsOptimizedImage.amazonLinux2023(amiHardwareType),
                         instanceMonitoring: Monitoring.BASIC,

package/dist/lib/patterns/aws/compute.js

@@ -78,7 +78,7 @@ export const COMPUTE_DEFAULTS = {
     },
     LAMBDA: {
         HANDLER: "index.handler",
-        RUNTIME: Runtime.NODEJS_22_X,
+        RUNTIME: Runtime.NODEJS_24_X,
         ARCHITECTURE: Architecture.ARM_64
     }
 };

package/dist/lib/patterns/aws/computeEcs.js

@@ -26,6 +26,7 @@ import { VALIDATION_PATTERNS } from "@fjall/generator";
 import { evaluateBakeGuard } from "@fjall/util/docker";
 import { toKebab, buildParameterPath } from "@fjall/util";
 import { validateEc2ServiceSizing, validateEcsDomainConfig, validateSecretName } from "../../resources/aws/compute/ecsValidation.js";
+import { validateSharedEc2CapacityConfig } from "../../resources/aws/compute/ecsCapacityConfig.js";
 import { COMPUTE_DEFAULTS, collectImportedSecretNames } from "./compute.js";
 import { isHookMigrations } from "./computeEcsTypes.js";
 export { ScalingType } from "./computeEcsTypes.js";
@@ -174,6 +175,10 @@ export function validateEcsProps(props) {
             validateSeparateTaskDef(service.name, service.migrations.separateTaskDef);
         }
     }
+    // Mirror of the resources-layer shared-ASG capacity check (drift on a reused
+    // ASG, shared persistentDataVolume singleton) — defence-in-depth per
+    // generator-standards § "Validate at the Lowest Layer the Field Belongs To".
+    validateSharedEc2CapacityConfig(props.services);
     // Validate awaitMigrationsFrom cross-service migration ordering.
     const serviceByName = new Map(props.services.map((s) => [s.name, s]));
     for (const service of props.services) {

package/dist/lib/patterns/aws/computeLambda.d.ts

@@ -201,7 +201,7 @@ export interface CodeLambdaProps extends BaseLambdaProps {
     code: Code;
     /** Handler function. Default: "index.handler" */
     handler?: string;
-    /** Lambda runtime. Default: NODEJS_22_X */
+    /** Lambda runtime. Default: NODEJS_24_X */
     runtime?: Runtime;
 }
 /**

package/dist/lib/patterns/aws/devSubstrate.js

@@ -317,7 +317,7 @@ export class DevSubstrate extends Construct {
         // control plane (ECS / Aurora / SSM), never over the VPC, and the ALB invokes
         // it through the Lambda API — not the network path.
         const waker = new LambdaFunction(this, DEV_SUBSTRATE_WAKER_ID, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: "Dev substrate slot waker",

package/dist/lib/patterns/aws/payload.js

@@ -308,7 +308,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.SERVER}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -370,7 +370,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.IMAGE}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,
@@ -396,7 +396,7 @@ export class Payload extends Construct {
             deployment: "code",
             code: Code.fromAsset(`${PAYLOAD_DEFAULTS.SOURCE}/${PAYLOAD_DEFAULTS.OPENNEXT.REVALIDATION}`),
             handler: "index.handler",
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             architecture: Architecture.ARM_64,
             memorySize,
             timeout,

package/dist/lib/patterns/aws/staticSite.js

@@ -42,7 +42,7 @@ import { toPascalCase } from "../../utils/capitaliseString.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const FORMS_ASSET_DIR = resolve(__dirname, "../../lambda-assets/static-site-forms/asset");
 const FORMS_DEFAULTS = {
-    RUNTIME: Runtime.NODEJS_22_X,
+    RUNTIME: Runtime.NODEJS_24_X,
     ARCHITECTURE: Architecture.ARM_64,
     TIMEOUT_SECONDS: 10,
     MEMORY_MB: 256,

package/dist/lib/resources/aws/compute/ec2.d.ts

@@ -4,28 +4,37 @@ import { Duration, Stack, type StackProps } from "aws-cdk-lib";
 import { type Role } from "aws-cdk-lib/aws-iam";
 import { AutoScalingGroup, Monitoring, type WarmPoolOptions } from "aws-cdk-lib/aws-autoscaling";
 import { type PersistentDataVolumeProps } from "./persistentDataVolume.js";
-export type Ec2InstancePersistentDataVolumeConfig = Omit<PersistentDataVolumeProps, "autoScalingGroup">;
+export type Ec2InstancePersistentDataVolumeConfig = Omit<PersistentDataVolumeProps, "autoScalingGroup" | "stableOwnerId">;
 /**
  * Caller-supplied ASG `UpdatePolicy` resolution. Default (`undefined`) →
- * `rollingUpdate({ minInstancesInService: 0, maxBatchSize: 1, pauseTime:
- * Duration.minutes(5) })`. The rolling shape propagates userdata mutations
- * to running instances on every `LaunchTemplateVersion` change; data
- * continuity for stateful patterns is preserved by `persistentDataVolume`.
+ * `instanceRefresh` with `minHealthyPercentage 0 / maxHealthyPercentage 100`
+ * when `persistentDataVolume` is set (single-attach EBS forbids a surge
+ * instance), `100 / 200` otherwise (surge-then-shrink, no capacity dip).
+ * Either shape propagates userdata/launch-template mutations to running
+ * instances on every `LaunchTemplateVersion` change; data continuity for
+ * stateful patterns is preserved by `persistentDataVolume`.
  *
  * Variants:
- * - `rollingUpdate` — single-instance roll; `pauseTime` overridable.
- *   `minInstancesInService` and `maxBatchSize` are fixed at `0` and `1`.
+ * - `instanceRefresh` — ASG-native rolling replacement via CFN
+ *   `UpdatePolicy.InstanceRefresh`; percentages overridable.
+ * - `rollingUpdate` — legacy CFN-driven single-instance roll; `pauseTime`
+ *   overridable. `minInstancesInService` and `maxBatchSize` are fixed at
+ *   `0` and `1`.
  * - `replacingUpdate` — explicit opt-in to the legacy full-replacement shape.
  *   No Fjall consumer uses this today; retained for future bare-EC2 patterns.
- * - `none` — no caller-driven `UpdatePolicy` (omits both
- *   `AutoScalingRollingUpdate` and `AutoScalingReplacingUpdate`). CDK still
- *   auto-emits `AutoScalingScheduledAction.IgnoreUnmodifiedGroupSizeProperties`
+ * - `none` — no caller-driven `UpdatePolicy` (omits the rolling, replacing
+ *   AND refresh blocks). CDK still auto-emits
+ *   `AutoScalingScheduledAction.IgnoreUnmodifiedGroupSizeProperties`
  *   regardless. For callers owning rollout externally.
  *
  * See `aiDocs/troubleshooting/clickhouse-rolling-update-window.md` for the
  * ClickHouse-specific downtime expectations.
  */
 export type Ec2InstanceUpdatePolicyConfig = {
+    type: "instanceRefresh";
+    minHealthyPercentage?: number;
+    maxHealthyPercentage?: number;
+} | {
     type: "rollingUpdate";
     pauseTime?: Duration;
 } | {
@@ -105,10 +114,18 @@ export interface Ec2InstanceProps extends StackProps {
      */
     persistentDataVolume?: Ec2InstancePersistentDataVolumeConfig;
     /**
-     * ASG `UpdatePolicy` resolution. Absent →
-     * `UpdatePolicy.rollingUpdate({ minInstancesInService: 0, maxBatchSize: 1,
-     * pauseTime: Duration.minutes(5) })`. Userdata mutations propagate to
-     * running instances via a single-batch rolling roll. See
+     * Stable owner identifier for the persistent data volume — becomes the
+     * volume's `fjall:OwnerLogicalId` tag and the re-attach Lambdas'
+     * `OWNER_LOGICAL_ID`. REQUIRED whenever `persistentDataVolume` is set
+     * (rejected at synth otherwise) so the re-attach identity is an explicit
+     * caller decision, never an accident of construct-tree position. Must
+     * remain byte-stable for the stack's whole life — changing it strands the
+     * deployed volume (the Lambda filter stops matching).
+     */
+    dataVolumeStableOwnerId?: string;
+    /**
+     * ASG `UpdatePolicy` resolution. Absent → `UpdatePolicy.instanceRefresh`
+     * (0/100 with `persistentDataVolume`, 100/200 otherwise). See
      * `Ec2InstanceUpdatePolicyConfig` for the variant menu and
      * `aiDocs/troubleshooting/clickhouse-rolling-update-window.md` for the
      * downtime-window runbook.

package/dist/lib/resources/aws/compute/ec2.js

@@ -3,7 +3,8 @@ import { Construct } from "constructs";
 import { resolvePrivateSubnetType } from "../../../utils/vpcUtils.js";
 import { safeEbs } from "./blockDeviceVolume.js";
 import { Duration, Stack, Tags } from "aws-cdk-lib";
-import { AutoScalingGroup, GroupMetrics, Monitoring, TerminationPolicy, UpdatePolicy, OnDemandAllocationStrategy, SpotAllocationStrategy } from "aws-cdk-lib/aws-autoscaling";
+import { AutoScalingGroup, GroupMetrics, InstanceRefreshStrategy, Monitoring, TerminationPolicy, UpdatePolicy, OnDemandAllocationStrategy, SpotAllocationStrategy } from "aws-cdk-lib/aws-autoscaling";
+import { DEFAULT_ROLLING_UPDATE_PAUSE_SECONDS, INSTANCE_REFRESH_DEFAULT_MAX_HEALTHY, INSTANCE_REFRESH_DEFAULT_MIN_HEALTHY, INSTANCE_REFRESH_PDV_MAX_HEALTHY, INSTANCE_REFRESH_PDV_MIN_HEALTHY } from "./ecsConstants.js";
 import { AwsCustomResource } from "../utilities/awsCustomResource.js";
 import { PhysicalResourceId } from "aws-cdk-lib/custom-resources";
 import { Vpc } from "../networking/vpc.js";
@@ -22,17 +23,17 @@ const DEFAULT_ROOT_DEVICE_NAME = "/dev/xvda";
 const DEFAULT_ROOT_VOLUME_SIZE_GIB = 30;
 /**
  * Resolve the caller's `updatePolicy` prop to a CDK `UpdatePolicy`. Default
- * (`config` absent) → single-instance rolling roll on every
- * `LaunchTemplateVersion` change. The `none` branch returns `undefined` so
- * `addAutoScalingGroup` can conditionally spread the field — passing
- * `updatePolicy: undefined` directly emits an empty `UpdatePolicy: {}` block
- * on some CDK versions.
+ * (`config` absent) → instance refresh, percentages keyed on
+ * `hasPersistentDataVolume` (see the constants above). The `none` branch
+ * returns `undefined` so `addAutoScalingGroup` can conditionally spread the
+ * field — passing `updatePolicy: undefined` directly emits an empty
+ * `UpdatePolicy: {}` block on some CDK versions.
  *
  * Free function rather than a private method: `this` state is not read, and
  * a free function is easier to reach from focused tests.
  */
-function resolveUpdatePolicy(config) {
-    const resolved = config ?? { type: "rollingUpdate" };
+function resolveUpdatePolicy(config, hasPersistentDataVolume) {
+    const resolved = config ?? { type: "instanceRefresh" };
     switch (resolved.type) {
         case "none":
             return undefined;
@@ -42,7 +43,20 @@ function resolveUpdatePolicy(config) {
             return UpdatePolicy.rollingUpdate({
                 minInstancesInService: 0,
                 maxBatchSize: 1,
-                pauseTime: resolved.pauseTime ?? Duration.minutes(5)
+                pauseTime: resolved.pauseTime ??
+                    Duration.seconds(DEFAULT_ROLLING_UPDATE_PAUSE_SECONDS)
+            });
+        case "instanceRefresh":
+            return UpdatePolicy.instanceRefresh({
+                strategy: InstanceRefreshStrategy.ROLLING,
+                minHealthyPercentage: resolved.minHealthyPercentage ??
+                    (hasPersistentDataVolume
+                        ? INSTANCE_REFRESH_PDV_MIN_HEALTHY
+                        : INSTANCE_REFRESH_DEFAULT_MIN_HEALTHY),
+                maxHealthyPercentage: resolved.maxHealthyPercentage ??
+                    (hasPersistentDataVolume
+                        ? INSTANCE_REFRESH_PDV_MAX_HEALTHY
+                        : INSTANCE_REFRESH_DEFAULT_MAX_HEALTHY)
             });
         default:
             return assertNever(resolved);
@@ -139,7 +153,7 @@ export class Ec2Instance extends Construct {
                 ? SubnetType.PUBLIC
                 : resolvePrivateSubnetType(this.vpc)
         };
-        const resolvedUpdatePolicy = resolveUpdatePolicy(props.updatePolicy);
+        const resolvedUpdatePolicy = resolveUpdatePolicy(props.updatePolicy, props.persistentDataVolume !== undefined);
         const baseAsgProps = {
             vpc: this.vpc,
             vpcSubnets,
@@ -242,8 +256,11 @@ export class Ec2Instance extends Construct {
     addPersistentDataVolume(props) {
         if (props.persistentDataVolume === undefined)
             return;
+        if (props.dataVolumeStableOwnerId === undefined)
+            return; // unreachable: validateEc2InstanceProps rejects the pair
         this.persistentDataVolume = new PersistentDataVolume(this, `${props.serviceName}PersistentDataVolume`, {
             autoScalingGroup: this.autoScalingGroup,
+            stableOwnerId: props.dataVolumeStableOwnerId,
             ...props.persistentDataVolume
         });
     }
@@ -282,6 +299,13 @@ function validateEc2InstanceProps(props) {
         throw new Error(`Ec2Instance.maxCapacity (${props.maxCapacity}) must be >= minCapacity (${props.minCapacity})`);
     }
     if (props.persistentDataVolume !== undefined) {
+        if (props.dataVolumeStableOwnerId === undefined ||
+            props.dataVolumeStableOwnerId === "") {
+            throw new Error("Ec2Instance.persistentDataVolume requires dataVolumeStableOwnerId — " +
+                "the volume's re-attach identity must be an explicit, stable " +
+                "caller decision (it becomes the fjall:OwnerLogicalId tag the " +
+                "lifecycle Lambdas filter on)");
+        }
         const azs = props.vpcSubnets?.availabilityZones;
         if (azs === undefined || azs.length !== 1) {
             throw new Error(`Ec2Instance.persistentDataVolume requires vpcSubnets.availabilityZones to be exactly 1 entry; got ${azs?.length ?? 0}`);

package/dist/lib/resources/aws/compute/ec2GracefulTerminationHandler.js

@@ -144,7 +144,7 @@ export class Ec2GracefulTerminationHandler extends Construct {
             ]
             : [];
         this.lambda = new LambdaFunction(this, `${id}Fn`, {
-            runtime: Runtime.NODEJS_22_X,
+            runtime: Runtime.NODEJS_24_X,
             handler: "index.handler",
             code: Code.fromInline(source),
             lambdaDescription: `${id} ${EC2_GRACEFUL_TERMINATION_HANDLER_DESCRIPTION}`,

package/dist/lib/resources/aws/compute/ecsCapacityConfig.d.ts

@@ -0,0 +1,83 @@
+import { type CapacityIdentityPin } from "@fjall/util";
+import type { Ec2CapacityConfig, EcsCapacityProvider } from "./ecsTypes.js";
+/** The service + ec2Config that first claimed a capacity slot. */
+export interface Ec2AsgOrigin {
+    serviceName: string;
+    ec2Config: Ec2CapacityConfig;
+    /** Identity anchor the slot's ASG was built with (pin-frozen or slot-derived). */
+    anchor: string;
+}
+/** The slot this ec2Config binds to (`"primary"` when undeclared). */
+export declare function resolveCapacitySlot(ec2Config: Ec2CapacityConfig): string;
+/** Rejects at synth a slot name outside the kebab grammar. */
+export declare function assertValidCapacitySlot(slot: string): void;
+/**
+ * The identity anchor every CloudFormation identity surface derives from.
+ * Precedence: explicit `identityAnchor` config pin, then the deploy-injected
+ * context pin's `legacyAnchor`, then `toPascalCase(slot)`. The anchor grammar
+ * is validated whichever source wins — a bad anchor corrupts every logical
+ * ID and physical name downstream.
+ */
+export declare function resolveCapacityAnchor(ec2Config: Ec2CapacityConfig, pin?: CapacityIdentityPin): string;
+/**
+ * Rejects at synth two slots whose anchors collide (`web-1` and `web1` both
+ * normalise to `Web1`) — colliding anchors mean colliding logical IDs.
+ * `anchorsBySlot` carries every anchor already resolved for the cluster.
+ */
+export declare function assertAnchorUnique(slot: string, anchor: string, anchorsBySlot: ReadonlyMap<string, string>): void;
+/**
+ * Rejects at synth when a service reusing a shared ASG is incompatible with
+ * it: the slot's identity is contested (`identityAnchor` disagreement), the
+ * origin's `persistentDataVolume` makes the slot a singleton (two tasks
+ * would race to attach the same EBS volume), or the reusing service asks for
+ * ASG settings that differ from the ones the ASG was built with — those
+ * settings would be silently ignored (same silent-ignore class as
+ * `validateEc2ServiceSizing`).
+ */
+export declare function assertSharedAsgConfigMatches(serviceName: string, ec2Config: Ec2CapacityConfig, slot: string, origin: Ec2AsgOrigin): void;
+/**
+ * Config fields that fed the pre-6.0 (config-keyed) identity derivation —
+ * the "identity derives from …" causes named in manifest identity aliases.
+ */
+export declare const LEGACY_KEY_FIELDS: readonly string[];
+/**
+ * The pre-6.0 config-derived identity key. SURVIVES ONLY as the legacy
+ * checksum behind manifest identity-alias hints (`legacyKey`/`legacyAnchor`)
+ * — it feeds no construct IDs, no physical names and no template properties.
+ * ASG sharing keys on the capacity SLOT.
+ */
+export declare function getEc2ConfigKey(ec2Config: Ec2CapacityConfig): string;
+/**
+ * The anchor a pre-6.0 synth derived from a config key — the exact `safeKey`
+ * strip the factory used (`key.replace(/[^a-zA-Z0-9]/g, "")`). Feeds the
+ * manifest alias hints and pin capture; never a live identity surface.
+ */
+export declare function legacyAnchorFromKey(key: string): string;
+/**
+ * Minimal structural input for {@link validateSharedEc2CapacityConfig} —
+ * exactly the fields the check reads. Both the resources-layer
+ * `EcsServiceProps` and the patterns-layer `EcsServiceConfig` structurally
+ * satisfy it (typescript-standards § "Helpers consume resolved state, not the
+ * dispatch enum").
+ */
+export interface SharedEc2CapacityServiceInput {
+    name: string;
+    capacityProvider?: EcsCapacityProvider;
+    ec2Config?: Ec2CapacityConfig;
+}
+/**
+ * Cross-service capacity-slot compatibility: validates slot grammar, rejects
+ * anchor collisions across slots, and rejects a slot reuse that is
+ * incompatible with the slot's origin — config drift the shared ASG would
+ * silently discard, a contested identity, or a `persistentDataVolume`
+ * singleton being shared. Pure; called from BOTH validation layers —
+ * resources `validateEcsClusterProps` and patterns `validateEcsProps`
+ * (generator-standards § "Validate at the Lowest Layer the Field Belongs To")
+ * — with the same checks at the construction site
+ * (`getOrCreateAsgCapacityProvider`) as defence-in-depth.
+ *
+ * Anchor collisions are checked on the PIN-BLIND anchor (`identityAnchor` or
+ * slot derivation) — this layer is pure and cannot read the deploy-injected
+ * context pins. The factory re-checks with pins applied.
+ */
+export declare function validateSharedEc2CapacityConfig(services: readonly SharedEc2CapacityServiceInput[]): void;