@fjall/components-infrastructure 5.0.0 → 7.0.0

package/dist/lib/utils/engineCompat.js

@@ -56,29 +56,39 @@ import { FjallLogger } from "./validationLogger.js";
 const PACKAGE_NAME = "@fjall/components-infrastructure";
 /**
  * Normalise an npm dependency RANGE to its minimum X.Y.Z floor: strip a leading
- * range operator (`^`, `~`, `>=`, `>`, `=`, `v`) and any prerelease/build
- * metadata, then reconstruct `${major}.${minor}.${patch}` (missing minor/patch
- * default to 0). Returns undefined for anything without a valid integer major —
- * so a non-semver range (a git URL, `*`) yields no floor and the caller omits
- * the field rather than emitting garbage.
+ * inclusive range operator (`^`, `~`, `>=`, `=`, `v`), then reconstruct
+ * `${major}.${minor}.${patch}` (missing minor/patch default to 0).
+ *
+ * Deliberately conservative — returns undefined (→ the caller omits the field,
+ * FM1 degrades to no-op) for every shape whose true floor the first-token strip
+ * would MIS-state rather than merely fail to state:
+ *   - unions (`^3 || ^2` floors at 2.0.0, not the first branch's 3.0.0)
+ *   - strict lower bounds (`>2.1134.0` excludes its own literal)
+ *   - prerelease bounds (`^2.0.0-rc.1` floors below the stripped 2.0.0)
+ *   - non-decimal segments (`1e2`, hex, `2.x`, `*`, git URLs, 4+ segments)
+ * A wrong floor is worse than no floor: over-strict refuses a valid engine,
+ * under-strict admits an incompatible one — both silently.
  */
 export function rangeFloor(range) {
     if (range === undefined || range.length === 0)
         return undefined;
-    const firstToken = range.trim().split(/\s+/)[0] ?? "";
-    const core = firstToken.replace(/^[\^~>=v ]+/i, "").split(/[-+]/)[0] ?? "";
-    if (core.length === 0)
+    const trimmed = range.trim();
+    if (trimmed.includes("||"))
+        return undefined;
+    const firstToken = trimmed.split(/\s+/)[0] ?? "";
+    if (/^>(?!=)/.test(firstToken))
+        return undefined;
+    const core = firstToken.replace(/^[\^~>=v ]+/i, "");
+    if (/[-+]/.test(core))
         return undefined;
     const parts = core.split(".");
+    if (parts.length === 0 || parts.length > 3)
+        return undefined;
+    if (!parts.every((segment) => /^\d+$/.test(segment)))
+        return undefined;
     const major = Number(parts[0]);
     const minor = parts.length > 1 ? Number(parts[1]) : 0;
     const patch = parts.length > 2 ? Number(parts[2]) : 0;
-    if (!Number.isInteger(major) || major < 0)
-        return undefined;
-    if (!Number.isInteger(minor) || minor < 0)
-        return undefined;
-    if (!Number.isInteger(patch) || patch < 0)
-        return undefined;
     return `${major}.${minor}.${patch}`;
 }
 /**
@@ -100,12 +110,20 @@ function resolveConstructsPackageMeta() {
                     typeof pkg.version === "string" &&
                     pkg.version.length > 0) {
                     const awsCdkPeer = pkg.peerDependencies?.["aws-cdk"];
-                    return {
-                        version: pkg.version,
-                        awsCdkCliFloor: typeof awsCdkPeer === "string"
-                            ? rangeFloor(awsCdkPeer)
-                            : undefined
-                    };
+                    const awsCdkCliFloor = typeof awsCdkPeer === "string" ? rangeFloor(awsCdkPeer) : undefined;
+                    if (awsCdkCliFloor === undefined) {
+                        // The FM1 omission is fail-safe but must never be silent — an
+                        // assembly without minimumAwsCdkCli skips the deploy engine's
+                        // CLI-floor check entirely.
+                        FjallLogger.warn(typeof awsCdkPeer === "string"
+                            ? `engineCompat: aws-cdk peer range "${awsCdkPeer}" has no ` +
+                                `derivable minimum floor — minimumAwsCdkCli will be ` +
+                                `omitted and the deploy engine's CLI-floor check skipped`
+                            : "engineCompat: no aws-cdk peerDependency found — " +
+                                "minimumAwsCdkCli will be omitted and the deploy " +
+                                "engine's CLI-floor check skipped");
+                    }
+                    return { version: pkg.version, awsCdkCliFloor };
                 }
             }
             if (dir === root)
@@ -150,9 +168,10 @@ export const AWS_CDK_CLI_FLOOR = CONSTRUCTS_PACKAGE_META?.awsCdkCliFloor;
 export function buildEngineCompatFrom(version, awsCdkCliFloor) {
     if (version === undefined || version.length === 0)
         return undefined;
-    const major = Number(version.split(".")[0]);
-    if (!Number.isInteger(major) || major < 0)
+    const majorToken = version.split(".")[0] ?? "";
+    if (!/^\d+$/.test(majorToken))
         return undefined;
+    const major = Number(majorToken);
     return {
         synthesisedBy: version,
         minimumEngineVersion: `${major}.0.0`,

package/dist/lib/utils/manifestWriter.d.ts

@@ -15,8 +15,8 @@
  */
 import type { CloudAssembly } from "aws-cdk-lib/cx-api";
 import { type ResourceCategory } from "@fjall/util/resourceCategorisation";
-import { type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type FjallManifest } from "@fjall/util/manifest/schemas";
-export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, ManifestStackHash, FjallManifest };
+import { type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ManifestCapacityAlias, type FjallManifest } from "@fjall/util/manifest/schemas";
+export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, ManifestStackHash, ManifestCapacityAlias, FjallManifest };
 /**
  * Collected manifest data during synthesis.
  * Stores all data that will be written to the manifest file.
@@ -24,6 +24,7 @@ export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, Man
 export declare class ManifestCollector {
     private services;
     private lambdas;
+    private capacityIdentityAliases;
     private pattern?;
     private ecr?;
     private appName;
@@ -46,6 +47,18 @@ export declare class ManifestCollector {
      * Add a Lambda function configuration.
      */
     addLambda(lambda: ManifestLambda): void;
+    /**
+     * Record a capacity-identity alias for one EC2 capacity slot. Slots are
+     * app-scoped — pins and rename detection route by `{appName, slot}` — so
+     * two clusters in one app declaring the same slot would silently share one
+     * identity (the same pin stamped on both ASGs, one cluster's alias
+     * dropped). Cross-cluster collision is therefore a hard synth error, per
+     * the design's same-slot-drift doctrine (§7 decision 3). A same-cluster
+     * duplicate cannot occur (slot re-entry early-returns in
+     * `getOrCreateAsgCapacityProvider` before alias emission) and is kept
+     * first-wins for safety.
+     */
+    addCapacityIdentityAlias(alias: ManifestCapacityAlias): void;
     /**
      * Set the pattern configuration.
      */
@@ -62,6 +75,10 @@ export declare class ManifestCollector {
      * Get collected Lambda functions.
      */
     getLambdas(): ManifestLambda[];
+    /**
+     * Get collected capacity-identity aliases.
+     */
+    getCapacityIdentityAliases(): ManifestCapacityAlias[];
     /**
      * Get pattern configuration.
      */

package/dist/lib/utils/manifestWriter.js

@@ -28,6 +28,7 @@ import { FjallLogger } from "./validationLogger.js";
 export class ManifestCollector {
     services = [];
     lambdas = [];
+    capacityIdentityAliases = [];
     pattern;
     ecr;
     appName;
@@ -64,6 +65,32 @@ export class ManifestCollector {
             this.lambdas.push(lambda);
         }
     }
+    /**
+     * Record a capacity-identity alias for one EC2 capacity slot. Slots are
+     * app-scoped — pins and rename detection route by `{appName, slot}` — so
+     * two clusters in one app declaring the same slot would silently share one
+     * identity (the same pin stamped on both ASGs, one cluster's alias
+     * dropped). Cross-cluster collision is therefore a hard synth error, per
+     * the design's same-slot-drift doctrine (§7 decision 3). A same-cluster
+     * duplicate cannot occur (slot re-entry early-returns in
+     * `getOrCreateAsgCapacityProvider` before alias emission) and is kept
+     * first-wins for safety.
+     */
+    addCapacityIdentityAlias(alias) {
+        const existing = this.capacityIdentityAliases.find((a) => a.appName === alias.appName && a.slot === alias.slot);
+        if (existing === undefined) {
+            this.capacityIdentityAliases.push(alias);
+            return;
+        }
+        if (existing.clusterName === alias.clusterName)
+            return;
+        throw new Error(`Capacity slot '${alias.slot}' is declared by two clusters in app ` +
+            `'${alias.appName}' ('${existing.clusterName}' and ` +
+            `'${alias.clusterName}'). A slot names ONE auto-scaling group per ` +
+            `app — capacity-identity pins and rename detection route by ` +
+            `{app, slot} and cannot tell the clusters apart. Give one cluster ` +
+            `a distinct ec2Config.slot.`);
+    }
     /**
      * Set the pattern configuration.
      */
@@ -88,6 +115,12 @@ export class ManifestCollector {
     getLambdas() {
         return this.lambdas;
     }
+    /**
+     * Get collected capacity-identity aliases.
+     */
+    getCapacityIdentityAliases() {
+        return this.capacityIdentityAliases;
+    }
     /**
      * Get pattern configuration.
      */
@@ -177,6 +210,7 @@ export function writeManifest(assembly, collector) {
             "engineCompat block; the deploy engine will proceed without a " +
             "version-compatibility gate.");
     }
+    const identityAliases = collector.getCapacityIdentityAliases();
     const manifest = {
         version: MANIFEST_SCHEMA_VERSION,
         generatedAt: new Date().toISOString(),
@@ -185,6 +219,7 @@ export function writeManifest(assembly, collector) {
         lambdas: collector.getLambdas(),
         stacks,
         ...(engineCompat !== undefined ? { engineCompat } : {}),
+        ...(identityAliases.length > 0 ? { identityAliases } : {}),
         ...(constructMap.size > 0
             ? { resourceMap: constructMapToRecord(constructMap) }
             : {})

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "5.0.0",
+  "version": "7.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fjall-tech/fjall.git",
+    "directory": "components/infrastructure"
+  },
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "bin": {
@@ -69,8 +74,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^5.0.0",
-    "@fjall/util": "^5.0.0",
+    "@fjall/generator": "^7.0.0",
+    "@fjall/util": "^7.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {
@@ -78,11 +83,10 @@
   },
   "peerDependencies": {
     "aws-cdk": "^2.1134.0",
-    "aws-cdk-lib": "^2.262.2",
+    "aws-cdk-lib": "^2.263.0",
     "constructs": "^10.7.2"
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "gitHead": "78dded6f582368076e8b5f351399219e5a954659"
+  }
 }

package/dist/lib/config/aws/identityCenterMembership.d.ts

@@ -1,11 +0,0 @@
-import { NestedStack, type NestedStackProps } from "aws-cdk-lib";
-import { type Construct } from "constructs";
-export interface IdentityCenterMembershipProps extends NestedStackProps {
-    identityStoreId: string;
-    groupId: string;
-    groupMembers: string[];
-}
-export declare function validateIdentityCenterMembershipProps(props: IdentityCenterMembershipProps): void;
-export declare class IdentityCenterMembership extends NestedStack {
-    constructor(scope: Construct, id: string, props: IdentityCenterMembershipProps);
-}

package/dist/lib/config/aws/identityCenterMembership.js

@@ -1,61 +0,0 @@
-import * as customResources from "aws-cdk-lib/custom-resources";
-import { NestedStack } from "aws-cdk-lib";
-import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
-import { GroupMembership } from "../../resources/aws/iam/identityCenter/groupMembership.js";
-import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
-const IDENTITY_STORE_SERVICE = "identityStore";
-export function validateIdentityCenterMembershipProps(props) {
-    if (!props.identityStoreId) {
-        throw new Error("IdentityCenterMembership requires identityStoreId from the parent IdentityCenter construct.");
-    }
-    if (!props.groupId) {
-        throw new Error("IdentityCenterMembership requires groupId from a Group construct.");
-    }
-    if (props.groupMembers.length === 0) {
-        throw new Error("IdentityCenterMembership requires at least one member email. Empty groups should be skipped at the caller.");
-    }
-    const seen = new Set();
-    for (const member of props.groupMembers) {
-        if (!member.includes("@")) {
-            throw new Error(`IdentityCenterMembership: "${member}" is not a valid email — Identity Center memberships look up users by UserName (email)`);
-        }
-        if (seen.has(member)) {
-            throw new Error(`Duplicate member "${member}" in IdentityCenterMembership groupMembers.`);
-        }
-        seen.add(member);
-    }
-}
-export class IdentityCenterMembership extends NestedStack {
-    constructor(scope, id, props) {
-        super(scope, id, props);
-        validateIdentityCenterMembershipProps(props);
-        for (const member of props.groupMembers) {
-            const [localPart] = member.split("@");
-            const suffix = stripAndCamelCase(localPart ?? member);
-            const listUsersCall = {
-                service: IDENTITY_STORE_SERVICE,
-                action: "listUsers",
-                parameters: {
-                    IdentityStoreId: props.identityStoreId,
-                    Filters: [
-                        {
-                            AttributePath: "UserName",
-                            AttributeValue: member
-                        }
-                    ]
-                },
-                physicalResourceId: customResources.PhysicalResourceId.of(`listUsers${suffix}`)
-            };
-            const userLookup = new AwsCustomResource(this, `User${suffix}`, {
-                onCreate: listUsersCall,
-                onUpdate: listUsersCall
-            });
-            const userId = userLookup.getResponseField("Users.0.UserId");
-            new GroupMembership(this, `Membership${suffix}`, {
-                identityStoreId: props.identityStoreId,
-                groupId: props.groupId,
-                userId
-            });
-        }
-    }
-}

package/dist/lib/layers/layers/secrets-resolver/bin/resolve-secrets

@@ -1,30 +0,0 @@
-#!/bin/bash
-# Fjall Secrets Resolver Wrapper
-#
-# Invoked by AWS_LAMBDA_EXEC_WRAPPER before the Lambda runtime starts.
-# Calls the Node.js resolver to fetch secrets from the AWS Parameters and
-# Secrets Extension, then execs into the original runtime bootstrap.
-#
-# The resolver outputs `export KEY='value'` lines which we eval to inject
-# secrets as environment variables visible to the handler.
-
-set -euo pipefail
-
-# Only run resolver if secrets are configured
-if [ -n "${SSM_SECRET_NAMES:-}" ] || env | grep -q '_SECRET_ARN='; then
-  RESOLVER_OUTPUT=$(/var/lang/bin/node /opt/bin/resolve-secrets.mjs)
-  if [ -n "$RESOLVER_OUTPUT" ]; then
-    # Validate each line matches `export NAME='...'` before eval to prevent
-    # accidental code execution if the resolver ever emits unexpected output
-    while IFS= read -r line; do
-      if [[ "$line" =~ ^export\ [a-zA-Z_][a-zA-Z0-9_]*= ]]; then
-        eval "$line"
-      else
-        echo "[fjall-resolver] Unexpected output from resolver: ${line:0:80}" >&2
-        exit 1
-      fi
-    done <<< "$RESOLVER_OUTPUT"
-  fi
-fi
-
-exec "$@"

package/dist/lib/layers/layers/secrets-resolver/bin/resolve-secrets.mjs

@@ -1,212 +0,0 @@
-/**
- * Fjall Secrets Resolver — runs before Lambda handler via AWS_LAMBDA_EXEC_WRAPPER.
- *
- * Resolves secrets from two sources using the AWS Parameters and Secrets Extension
- * HTTP cache at localhost:2773:
- *
- * 1. SSM Parameter Store (user-managed secrets via `fjall secrets set`)
- *    Reads SSM_SECRETS_PATH + SSM_SECRET_NAMES, fetches each parameter,
- *    exports as environment variables.
- *
- * 2. Secrets Manager (CDK-managed secrets, e.g. database credentials)
- *    Scans for *_SECRET_ARN env vars, fetches each secret,
- *    optionally extracts a JSON field via the matching *_SECRET_FIELD var,
- *    exports as the prefix (e.g. DATABASE_PASSWORD_SECRET_ARN → DATABASE_PASSWORD).
- *
- * Outputs `export KEY='value'` lines to stdout. The bash wrapper evals this output
- * and then execs into the Lambda runtime.
- *
- * The Extension may not be ready immediately during INIT phase, so all HTTP
- * calls use a retry loop with exponential backoff.
- */
-
-const EXTENSION_PORT = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT || "2773";
-const EXTENSION_URL = `http://localhost:${EXTENSION_PORT}`;
-const MAX_RETRIES = 5;
-const INITIAL_DELAY_MS = 100;
-/** Per-request timeout — generous for localhost; total budget bounded by Lambda INIT timeout */
-const REQUEST_TIMEOUT_MS = 2000;
-
-/**
- * Fetch from the Extension HTTP API with retry and exponential backoff.
- * The Extension starts during INIT phase 1 (Extension init) and the wrapper
- * runs during INIT phase 2 (Runtime init), so it is usually ready — but
- * a retry loop handles the timing edge case.
- */
-async function fetchWithRetry(path) {
-  let delay = INITIAL_DELAY_MS;
-  let lastError;
-
-  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-    try {
-      const response = await fetch(`${EXTENSION_URL}${path}`, {
-        headers: {
-          "X-Aws-Parameters-Secrets-Token": process.env.AWS_SESSION_TOKEN,
-        },
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-      });
-      if (response.ok) {
-        return await response.json();
-      }
-      // 4xx errors (e.g. secret not found) — don't retry
-      if (response.status >= 400 && response.status < 500) {
-        const body = await response.text().catch(() => "");
-        const err = new Error(`Extension returned ${response.status}: ${body}`);
-        err.nonRetriable = true;
-        throw err;
-      }
-      // 5xx — retriable
-      const body = await response.text().catch(() => "");
-      lastError = new Error(`Extension returned ${response.status}: ${body}`);
-    } catch (err) {
-      if (err.nonRetriable) {
-        throw err;
-      }
-      lastError = err;
-    }
-
-    // Retry with backoff (both 5xx and network errors)
-    if (attempt < MAX_RETRIES - 1) {
-      await new Promise((r) => setTimeout(r, delay));
-      delay *= 2;
-    }
-  }
-
-  throw new Error(
-    `Failed to reach Extension after ${MAX_RETRIES} attempts: ${lastError?.message}`,
-  );
-}
-
-/**
- * Escape a value for safe inclusion in a shell `export KEY='value'` statement.
- * Single-quotes are the safest quoting mechanism — only embedded single-quotes
- * need escaping via the close-reopen pattern: ' → '\''
- */
-function shellEscape(value) {
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-
-// POSIX env var names: letters, digits, underscores; must not start with a digit
-const VALID_ENV_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-
-function assertValidEnvName(name, source) {
-  if (!VALID_ENV_NAME.test(name)) {
-    process.stderr.write(
-      `[fjall-resolver] Invalid env var name '${name}' from ${source}. ` +
-        `Names must match [a-zA-Z_][a-zA-Z0-9_]* (no dots or hyphens).\n`,
-    );
-    process.exit(1);
-  }
-}
-
-/**
- * Resolve SSM Parameter Store secrets.
- * Reads SSM_SECRETS_PATH and SSM_SECRET_NAMES, fetches each SecureString parameter.
- */
-async function resolveSsmSecrets() {
-  const basePath = process.env.SSM_SECRETS_PATH;
-  const secretNames = process.env.SSM_SECRET_NAMES;
-
-  if (!basePath || !secretNames) return [];
-
-  const names = secretNames.split(",").filter(Boolean);
-  const exports = [];
-
-  for (const name of names) {
-    assertValidEnvName(name, "SSM_SECRET_NAMES");
-    const paramPath = `${basePath}/${name}`;
-    const encodedPath = encodeURIComponent(paramPath);
-
-    try {
-      const data = await fetchWithRetry(
-        `/systemsmanager/parameters/get?name=${encodedPath}&withDecryption=true`,
-      );
-      const value = data?.Parameter?.Value;
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${name}=${shellEscape(value)}`);
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        `[fjall-resolver] Failed to resolve SSM parameter ${paramPath}: ${msg}\n`,
-      );
-      process.exit(1);
-    }
-  }
-
-  return exports;
-}
-
-/**
- * Resolve Secrets Manager secrets.
- * Scans for *_SECRET_ARN env vars, fetches each secret from SM,
- * optionally extracts a JSON field, and exports as the prefix.
- */
-async function resolveSecretsManagerSecrets() {
-  const exports = [];
-
-  for (const [key, arn] of Object.entries(process.env)) {
-    if (!key.endsWith("_SECRET_ARN") || !arn) continue;
-
-    const prefix = key.slice(0, -"_SECRET_ARN".length);
-    assertValidEnvName(prefix, "Secrets Manager");
-    const fieldKey = `${prefix}_SECRET_FIELD`;
-    const field = process.env[fieldKey];
-
-    const encodedArn = encodeURIComponent(arn);
-
-    try {
-      const data = await fetchWithRetry(
-        `/secretsmanager/get?secretId=${encodedArn}`,
-      );
-
-      let value;
-      if (field && data?.SecretString) {
-        let parsed;
-        try {
-          parsed = JSON.parse(data.SecretString);
-        } catch {
-          throw new Error(
-            `Secret is not valid JSON but field '${field}' was requested. Store the secret as a JSON object.`,
-          );
-        }
-        value = parsed[field];
-        if (value === undefined) {
-          throw new Error(
-            `Field '${field}' not found in secret (${Object.keys(parsed).length} fields present).`,
-          );
-        }
-      } else {
-        value = data?.SecretString;
-      }
-
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${prefix}=${shellEscape(String(value))}`);
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        `[fjall-resolver] Failed to resolve SM secret ${prefix} (${arn}): ${msg}\n`,
-      );
-      process.exit(1);
-    }
-  }
-
-  return exports;
-}
-
-async function main() {
-  const ssmExports = await resolveSsmSecrets();
-  const smExports = await resolveSecretsManagerSecrets();
-  const allExports = [...ssmExports, ...smExports];
-
-  if (allExports.length > 0) {
-    process.stdout.write(allExports.join("\n") + "\n");
-  }
-}
-
-main().catch((err) => {
-  const msg = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`[fjall-resolver] Fatal error: ${msg}\n`);
-  process.exit(1);
-});

package/dist/lib/patterns/aws/buildkite/alarms.d.ts

@@ -1,25 +0,0 @@
-import type { Construct } from "constructs";
-export interface BuildkiteAlarmParams {
-    readonly buildkiteOrgSlug: string;
-    readonly buildkiteQueue: string;
-    readonly autoScalingGroupName: string;
-    /**
-     * Alarm-action destination, in either `resolveAlertsTopic` string shape:
-     * a literal `arn:...` or `"import:<ExportName>"` (e.g.
-     * `"import:SharedAlarmTopicArn"`). Omitted → alarms exist but page nobody.
-     */
-    readonly alarmSnsTopicArn?: string;
-}
-/**
- * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
- * posture is honest only with these:
- *
- * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
- *    The scaler publishes every poll, so metric absence means the scaler
- *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
- *    entire mechanism.
- * 2. Queued with zero capacity — jobs scheduled while the ASG has no
- *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
- *    quota, subnet failure) while work is waiting.
- */
-export declare function addBuildkiteAlarms(scope: Construct, params: BuildkiteAlarmParams): void;

package/dist/lib/patterns/aws/buildkite/alarms.js

@@ -1,78 +0,0 @@
-import { Duration } from "aws-cdk-lib";
-import { Alarm, ComparisonOperator, MathExpression, Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
-import { SnsAction } from "aws-cdk-lib/aws-cloudwatch-actions";
-import { resolveAlertsTopic } from "../../../utils/resolveAlertsTopic.js";
-/**
- * Metrics namespace the buildkite-agent-scaler publishes to, dimensioned by
- * {Org, Queue} — BOTH dimensions are required; querying Queue alone reads no
- * data (CloudWatch dimension matching is exact-set), leaving the heartbeat
- * permanently ALARM and the queued alarm permanently inert. Phase-1b rollout
- * gate: verify both metrics carry data after the first build before trusting
- * the alarms (design § D13/D14) — a namespace/dimension mismatch here is
- * invisible to the synth tests.
- */
-const SCALER_METRICS_NAMESPACE = "Buildkite";
-/**
- * The fleet's two Phase-1 alarms (design § D14) — the "~zero babysitting"
- * posture is honest only with these:
- *
- * 1. Scaler heartbeat — `ScheduledJobsCount` goes MISSING for 15 minutes.
- *    The scaler publishes every poll, so metric absence means the scaler
- *    Lambda is dead or failing; `treatMissingData: BREACHING` is the alarm's
- *    entire mechanism.
- * 2. Queued with zero capacity — jobs scheduled while the ASG has no
- *    in-service instances for 15 minutes: the fleet cannot boot (AMI gone,
- *    quota, subnet failure) while work is waiting.
- */
-export function addBuildkiteAlarms(scope, params) {
-    const scheduledJobs = new Metric({
-        namespace: SCALER_METRICS_NAMESPACE,
-        metricName: "ScheduledJobsCount",
-        dimensionsMap: {
-            Org: params.buildkiteOrgSlug,
-            Queue: params.buildkiteQueue
-        },
-        statistic: "Maximum",
-        period: Duration.minutes(5)
-    });
-    const heartbeatAlarm = new Alarm(scope, "ScalerHeartbeatAlarm", {
-        alarmDescription: `Buildkite scaler for queue '${params.buildkiteQueue}' has stopped ` +
-            "publishing metrics — scaler Lambda dead or erroring. Jobs will queue " +
-            "with no scale-out.",
-        metric: scheduledJobs,
-        comparisonOperator: ComparisonOperator.LESS_THAN_THRESHOLD,
-        threshold: 0,
-        evaluationPeriods: 3,
-        treatMissingData: TreatMissingData.BREACHING
-    });
-    const inServiceInstances = new Metric({
-        namespace: "AWS/AutoScaling",
-        metricName: "GroupInServiceInstances",
-        dimensionsMap: { AutoScalingGroupName: params.autoScalingGroupName },
-        statistic: "Maximum",
-        period: Duration.minutes(5)
-    });
-    const queuedWithZeroCapacity = new MathExpression({
-        expression: "IF(scheduled > 0 AND inService == 0, 1, 0)",
-        usingMetrics: {
-            scheduled: scheduledJobs,
-            inService: inServiceInstances
-        },
-        period: Duration.minutes(5)
-    });
-    const queuedAlarm = new Alarm(scope, "QueuedWithZeroCapacityAlarm", {
-        alarmDescription: `Buildkite queue '${params.buildkiteQueue}' has scheduled jobs but ` +
-            "zero in-service agents for 15 minutes — the fleet cannot boot " +
-            "(AMI, quota, or subnet failure) while work waits.",
-        metric: queuedWithZeroCapacity,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
-        threshold: 1,
-        evaluationPeriods: 3,
-        treatMissingData: TreatMissingData.NOT_BREACHING
-    });
-    const topic = resolveAlertsTopic(scope, "BuildkiteAlarmTopic", params.alarmSnsTopicArn);
-    if (topic !== undefined) {
-        heartbeatAlarm.addAlarmAction(new SnsAction(topic));
-        queuedAlarm.addAlarmAction(new SnsAction(topic));
-    }
-}