@fjall/components-infrastructure 6.0.0 → 7.0.0

package/dist/lib/resources/aws/compute/ecsTypes.d.ts

@@ -22,7 +22,7 @@ import type { ManagedDomainBinding, ManagedDomainExports } from "../../../utils/
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import type { ILogGroup } from "aws-cdk-lib/aws-logs";
 import type { EcsServiceAlarmThresholds, LogPatternAlarmSpec } from "../monitoring/index.js";
-import { type Ec2InstancePersistentDataVolumeConfig } from "./ec2.js";
+import { type Ec2InstancePersistentDataVolumeConfig, type Ec2InstanceUpdatePolicyConfig } from "./ec2.js";
 export declare enum Protocol {
     HTTP = 0,
     HTTPS = 1
@@ -94,6 +94,26 @@ export type { EcsCapacityProvider };
  * Only used when capacityProvider is "EC2".
  */
 export interface Ec2CapacityConfig {
+    /**
+     * Capacity SLOT — the stable, operator-chosen identity for this ASG within
+     * its cluster. Lowercase kebab (`CAPACITY_SLOT_PATTERN` from `@fjall/util`),
+     * max 64 chars. Default: `"primary"`. Every CloudFormation identity surface
+     * (logical-ID prefixes, physical service name, launch-template name)
+     * derives from the slot's ANCHOR (`toPascalCase(slot)`), never from the
+     * hardware config — changing `instanceType` or any other property updates
+     * the ASG in place instead of renaming (replacing) it. Services declaring
+     * the same slot share its ASG and must agree on every property field
+     * (`assertSharedAsgConfigMatches`).
+     */
+    slot?: string;
+    /**
+     * Explicit identity-anchor pin. When present it wins over both the
+     * slot-derived anchor AND any `fjall:capacityIdentity` context pin. Must
+     * match `CAPACITY_ANCHOR_PATTERN` (alphanumeric, letter first). Primarily
+     * for freezing a deployed pre-6.0 config-derived identity; new stacks
+     * should rely on the slot derivation.
+     */
+    identityAnchor?: string;
     /** EC2 instance type. Default: "t4g.micro" */
     instanceType?: string;
     /** AMI hardware type. Default: "ARM" (Graviton - better cost/performance) */
@@ -151,9 +171,9 @@ export interface Ec2CapacityConfig {
      * Pairs the EC2 capacity ASG with a standalone EBS data volume that
      * re-attaches across instance refreshes. Forwarded to `Ec2Instance` which
      * locates and detaches the volume via TERMINATING/LAUNCHING lifecycle
-     * hooks. Implies a singleton service — do not share an ASG across
-     * services when this is set (`getEc2ConfigKey` adds a discriminator to
-     * keep them apart).
+     * hooks. Implies a singleton service — a second service declaring the
+     * same slot is rejected at synth (`assertSharedAsgConfigMatches`); give
+     * it its own slot instead.
      */
     persistentDataVolume?: Ec2InstancePersistentDataVolumeConfig;
     /**
@@ -163,6 +183,15 @@ export interface Ec2CapacityConfig {
      * Empty-string keys or values are rejected at the resources layer.
      */
     tags?: Record<string, string>;
+    /**
+     * ASG `UpdatePolicy` passthrough, forwarded to `Ec2Instance` verbatim.
+     * Absent → `instanceRefresh` with `minHealthyPercentage 0 /
+     * maxHealthyPercentage 100` when the slot owns a `persistentDataVolume`
+     * (single-attach EBS forbids surge), `100 / 200` otherwise (surge-then
+     * -shrink, no capacity dip). A property field, not identity — changing it
+     * never renames the ASG.
+     */
+    updatePolicy?: Ec2InstanceUpdatePolicyConfig;
 }
 /**
  * Explicit Route53 latency routing policy for the cluster's alias records

package/dist/lib/resources/aws/compute/persistentDataVolume.d.ts

@@ -19,6 +19,16 @@ export declare const PERSISTENT_DATA_VOLUME_TAG_STACK_ID = "fjall:StackId";
 export interface PersistentDataVolumeProps {
     /** ASG whose EC2_INSTANCE_LAUNCHING transitions trigger the re-attach. */
     autoScalingGroup: AutoScalingGroup;
+    /**
+     * Stable owner identifier — becomes the volume's `fjall:OwnerLogicalId`
+     * tag and the Lambdas' `OWNER_LOGICAL_ID` env. An explicit prop (not
+     * `this.node.path`) so the re-attach identity survives construct-tree
+     * refactors: renaming or reparenting an ancestor must never strand the
+     * deployed volume. Must remain byte-stable for the stack's whole life;
+     * for a stack deployed before the identity-anchor era, pass the deployed
+     * tag value verbatim (the pin's `legacyOwnerId`).
+     */
+    stableOwnerId: string;
     /** Size in GiB. */
     sizeGb: number;
     /** Device path the bootstrap script expects (e.g. /dev/xvdf). */
@@ -56,7 +66,7 @@ export interface PersistentDataVolumeProps {
  *
  * Volume tagging: three tags carry the re-attach identity —
  *   `fjall:Lifecycle = data-volume` (constant; gates IAM scoping)
- *   `fjall:OwnerLogicalId = <this.node.path>` (per-construct, stable across
+ *   `fjall:OwnerLogicalId = <props.stableOwnerId>` (per-slot, stable across
  *     instance refreshes in one stack so the Lambda re-finds the same volume)
  *   `fjall:StackId = <Aws.STACK_ID>` (per-stack-creation discriminator;
  *     CloudFormation issues a fresh StackId for every CREATE, so orphans
@@ -89,10 +99,10 @@ export declare class PersistentDataVolume extends Construct {
      * Identifier used as the `fjall:OwnerLogicalId` tag on the volume and the
      * `OWNER_LOGICAL_ID` env on the Lambda. Consumers MUST pass this exact
      * value to the TERMINATING handler so it locates the same volume for
-     * detach. Derived from `this.node.path`; renaming or reparenting any
-     * ancestor changes the value, which breaks the re-attach chain (Lambda
-     * filter no longer matches, new instance fails its launch hook). Rename
-     * across an existing deployment is a manual snapshot-restore step.
+     * detach. Carries `props.stableOwnerId` verbatim; changing it across an
+     * existing deployment breaks the re-attach chain (Lambda filter no longer
+     * matches, new instance fails its launch hook) — recovery is a manual
+     * snapshot-restore step.
      */
     readonly ownerLogicalId: string;
     readonly attachFailureAlarm: Alarm;

package/dist/lib/resources/aws/compute/persistentDataVolume.js

@@ -46,7 +46,7 @@ const ALARM_THRESHOLD = 1;
  *
  * Volume tagging: three tags carry the re-attach identity —
  *   `fjall:Lifecycle = data-volume` (constant; gates IAM scoping)
- *   `fjall:OwnerLogicalId = <this.node.path>` (per-construct, stable across
+ *   `fjall:OwnerLogicalId = <props.stableOwnerId>` (per-slot, stable across
  *     instance refreshes in one stack so the Lambda re-finds the same volume)
  *   `fjall:StackId = <Aws.STACK_ID>` (per-stack-creation discriminator;
  *     CloudFormation issues a fresh StackId for every CREATE, so orphans
@@ -79,17 +79,17 @@ export class PersistentDataVolume extends Construct {
      * Identifier used as the `fjall:OwnerLogicalId` tag on the volume and the
      * `OWNER_LOGICAL_ID` env on the Lambda. Consumers MUST pass this exact
      * value to the TERMINATING handler so it locates the same volume for
-     * detach. Derived from `this.node.path`; renaming or reparenting any
-     * ancestor changes the value, which breaks the re-attach chain (Lambda
-     * filter no longer matches, new instance fails its launch hook). Rename
-     * across an existing deployment is a manual snapshot-restore step.
+     * detach. Carries `props.stableOwnerId` verbatim; changing it across an
+     * existing deployment breaks the re-attach chain (Lambda filter no longer
+     * matches, new instance fails its launch hook) — recovery is a manual
+     * snapshot-restore step.
      */
     ownerLogicalId;
     attachFailureAlarm;
     constructor(scope, id, props) {
         super(scope, id);
         validatePersistentDataVolumeProps(props);
-        this.ownerLogicalId = this.node.path;
+        this.ownerLogicalId = props.stableOwnerId;
         this.volume = new Volume(this, "Volume", {
             availabilityZone: props.availabilityZone,
             size: Size.gibibytes(props.sizeGb),
@@ -236,6 +236,9 @@ function validatePersistentDataVolumeProps(props) {
     if (props.deviceName === "") {
         throw new Error("PersistentDataVolume.deviceName must be non-empty");
     }
+    if (props.stableOwnerId === "") {
+        throw new Error("PersistentDataVolume.stableOwnerId must be non-empty");
+    }
     if (props.availabilityZone === "") {
         throw new Error("PersistentDataVolume.availabilityZone must be non-empty");
     }

package/dist/lib/utils/capacityIdentityContext.d.ts

@@ -0,0 +1,20 @@
+import type { Construct } from "constructs";
+import { type CapacityIdentityPin, type CapacityIdentityWire } from "@fjall/util";
+/**
+ * Reader for the `fjall:capacityIdentity` CDK context the deploy engine
+ * injects (already projected to the current deploy target — see
+ * `@fjall/util § capacityIdentity` for the wire contract).
+ *
+ * Malformed context is a LOUD synth error, never a silent skip: a pin that
+ * fails to apply would synth the slot unpinned, and the resulting template
+ * renames (replaces) every stateful resource in the slot. The deploy-time
+ * rename gate would catch that downstream, but the failure must name the
+ * real cause — the malformed pin — not surface as a mystery rename.
+ */
+export declare function readCapacityIdentityPins(scope: Construct): CapacityIdentityWire | undefined;
+/**
+ * The pin for one `{ appName, slot }`, or undefined when the app/slot is
+ * unpinned. `appName` must be the manifest appName — the same value the pin
+ * writer records.
+ */
+export declare function lookupCapacityIdentityPin(scope: Construct, appName: string, slot: string): CapacityIdentityPin | undefined;

package/dist/lib/utils/capacityIdentityContext.js

@@ -0,0 +1,43 @@
+import { CAPACITY_IDENTITY_CONTEXT_KEY, CapacityIdentityWireSchema } from "@fjall/util";
+/**
+ * Reader for the `fjall:capacityIdentity` CDK context the deploy engine
+ * injects (already projected to the current deploy target — see
+ * `@fjall/util § capacityIdentity` for the wire contract).
+ *
+ * Malformed context is a LOUD synth error, never a silent skip: a pin that
+ * fails to apply would synth the slot unpinned, and the resulting template
+ * renames (replaces) every stateful resource in the slot. The deploy-time
+ * rename gate would catch that downstream, but the failure must name the
+ * real cause — the malformed pin — not surface as a mystery rename.
+ */
+export function readCapacityIdentityPins(scope) {
+    const raw = scope.node.tryGetContext(CAPACITY_IDENTITY_CONTEXT_KEY);
+    if (raw === undefined)
+        return undefined;
+    let value = raw;
+    if (typeof raw === "string") {
+        // `-c key=value` always arrives as a string; tests may set the object form.
+        try {
+            value = JSON.parse(raw);
+        }
+        catch (error) {
+            throw new Error(`${CAPACITY_IDENTITY_CONTEXT_KEY} context is not valid JSON: ` +
+                `${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+    }
+    const parsed = CapacityIdentityWireSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new Error(`${CAPACITY_IDENTITY_CONTEXT_KEY} context is malformed — refusing to ` +
+            `synth with a pin that cannot apply (an unpinned synth would rename ` +
+            `every stateful resource in the slot): ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+/**
+ * The pin for one `{ appName, slot }`, or undefined when the app/slot is
+ * unpinned. `appName` must be the manifest appName — the same value the pin
+ * writer records.
+ */
+export function lookupCapacityIdentityPin(scope, appName, slot) {
+    return readCapacityIdentityPins(scope)?.[appName]?.[slot];
+}

package/dist/lib/utils/manifestWriter.d.ts

@@ -15,8 +15,8 @@
  */
 import type { CloudAssembly } from "aws-cdk-lib/cx-api";
 import { type ResourceCategory } from "@fjall/util/resourceCategorisation";
-import { type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type FjallManifest } from "@fjall/util/manifest/schemas";
-export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, ManifestStackHash, FjallManifest };
+import { type ManifestService, type ManifestPattern, type ManifestEcr, type ManifestLambda, type ManifestStackHash, type ManifestCapacityAlias, type FjallManifest } from "@fjall/util/manifest/schemas";
+export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, ManifestStackHash, ManifestCapacityAlias, FjallManifest };
 /**
  * Collected manifest data during synthesis.
  * Stores all data that will be written to the manifest file.
@@ -24,6 +24,7 @@ export type { ManifestService, ManifestPattern, ManifestEcr, ManifestLambda, Man
 export declare class ManifestCollector {
     private services;
     private lambdas;
+    private capacityIdentityAliases;
     private pattern?;
     private ecr?;
     private appName;
@@ -46,6 +47,18 @@ export declare class ManifestCollector {
      * Add a Lambda function configuration.
      */
     addLambda(lambda: ManifestLambda): void;
+    /**
+     * Record a capacity-identity alias for one EC2 capacity slot. Slots are
+     * app-scoped — pins and rename detection route by `{appName, slot}` — so
+     * two clusters in one app declaring the same slot would silently share one
+     * identity (the same pin stamped on both ASGs, one cluster's alias
+     * dropped). Cross-cluster collision is therefore a hard synth error, per
+     * the design's same-slot-drift doctrine (§7 decision 3). A same-cluster
+     * duplicate cannot occur (slot re-entry early-returns in
+     * `getOrCreateAsgCapacityProvider` before alias emission) and is kept
+     * first-wins for safety.
+     */
+    addCapacityIdentityAlias(alias: ManifestCapacityAlias): void;
     /**
      * Set the pattern configuration.
      */
@@ -62,6 +75,10 @@ export declare class ManifestCollector {
      * Get collected Lambda functions.
      */
     getLambdas(): ManifestLambda[];
+    /**
+     * Get collected capacity-identity aliases.
+     */
+    getCapacityIdentityAliases(): ManifestCapacityAlias[];
     /**
      * Get pattern configuration.
      */

package/dist/lib/utils/manifestWriter.js

@@ -28,6 +28,7 @@ import { FjallLogger } from "./validationLogger.js";
 export class ManifestCollector {
     services = [];
     lambdas = [];
+    capacityIdentityAliases = [];
     pattern;
     ecr;
     appName;
@@ -64,6 +65,32 @@ export class ManifestCollector {
             this.lambdas.push(lambda);
         }
     }
+    /**
+     * Record a capacity-identity alias for one EC2 capacity slot. Slots are
+     * app-scoped — pins and rename detection route by `{appName, slot}` — so
+     * two clusters in one app declaring the same slot would silently share one
+     * identity (the same pin stamped on both ASGs, one cluster's alias
+     * dropped). Cross-cluster collision is therefore a hard synth error, per
+     * the design's same-slot-drift doctrine (§7 decision 3). A same-cluster
+     * duplicate cannot occur (slot re-entry early-returns in
+     * `getOrCreateAsgCapacityProvider` before alias emission) and is kept
+     * first-wins for safety.
+     */
+    addCapacityIdentityAlias(alias) {
+        const existing = this.capacityIdentityAliases.find((a) => a.appName === alias.appName && a.slot === alias.slot);
+        if (existing === undefined) {
+            this.capacityIdentityAliases.push(alias);
+            return;
+        }
+        if (existing.clusterName === alias.clusterName)
+            return;
+        throw new Error(`Capacity slot '${alias.slot}' is declared by two clusters in app ` +
+            `'${alias.appName}' ('${existing.clusterName}' and ` +
+            `'${alias.clusterName}'). A slot names ONE auto-scaling group per ` +
+            `app — capacity-identity pins and rename detection route by ` +
+            `{app, slot} and cannot tell the clusters apart. Give one cluster ` +
+            `a distinct ec2Config.slot.`);
+    }
     /**
      * Set the pattern configuration.
      */
@@ -88,6 +115,12 @@ export class ManifestCollector {
     getLambdas() {
         return this.lambdas;
     }
+    /**
+     * Get collected capacity-identity aliases.
+     */
+    getCapacityIdentityAliases() {
+        return this.capacityIdentityAliases;
+    }
     /**
      * Get pattern configuration.
      */
@@ -177,6 +210,7 @@ export function writeManifest(assembly, collector) {
             "engineCompat block; the deploy engine will proceed without a " +
             "version-compatibility gate.");
     }
+    const identityAliases = collector.getCapacityIdentityAliases();
     const manifest = {
         version: MANIFEST_SCHEMA_VERSION,
         generatedAt: new Date().toISOString(),
@@ -185,6 +219,7 @@ export function writeManifest(assembly, collector) {
         lambdas: collector.getLambdas(),
         stacks,
         ...(engineCompat !== undefined ? { engineCompat } : {}),
+        ...(identityAliases.length > 0 ? { identityAliases } : {}),
         ...(constructMap.size > 0
             ? { resourceMap: constructMapToRecord(constructMap) }
             : {})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/components-infrastructure",
-  "version": "6.0.0",
+  "version": "7.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fjall-tech/fjall.git",
@@ -74,8 +74,8 @@
   },
   "dependencies": {
     "@aws-sdk/client-organizations": "^3.1098.0",
-    "@fjall/generator": "^6.0.0",
-    "@fjall/util": "^6.0.0",
+    "@fjall/generator": "^7.0.0",
+    "@fjall/util": "^7.0.0",
     "constructs": "^10.7.2"
   },
   "overrides": {
@@ -88,6 +88,5 @@
   },
   "engines": {
     "node": ">=18.0.0"
-  },
-  "gitHead": "7620fc7c93bbef1046580d6568546afe3cd450a7"
+  }
 }

package/dist/lib/config/aws/identityCenterMembership.d.ts

@@ -1,11 +0,0 @@
-import { NestedStack, type NestedStackProps } from "aws-cdk-lib";
-import { type Construct } from "constructs";
-export interface IdentityCenterMembershipProps extends NestedStackProps {
-    identityStoreId: string;
-    groupId: string;
-    groupMembers: string[];
-}
-export declare function validateIdentityCenterMembershipProps(props: IdentityCenterMembershipProps): void;
-export declare class IdentityCenterMembership extends NestedStack {
-    constructor(scope: Construct, id: string, props: IdentityCenterMembershipProps);
-}

package/dist/lib/config/aws/identityCenterMembership.js

@@ -1,61 +0,0 @@
-import * as customResources from "aws-cdk-lib/custom-resources";
-import { NestedStack } from "aws-cdk-lib";
-import { AwsCustomResource } from "../../resources/aws/utilities/awsCustomResource.js";
-import { GroupMembership } from "../../resources/aws/iam/identityCenter/groupMembership.js";
-import { stripAndCamelCase } from "../../utils/stripAndCamelCase.js";
-const IDENTITY_STORE_SERVICE = "identityStore";
-export function validateIdentityCenterMembershipProps(props) {
-    if (!props.identityStoreId) {
-        throw new Error("IdentityCenterMembership requires identityStoreId from the parent IdentityCenter construct.");
-    }
-    if (!props.groupId) {
-        throw new Error("IdentityCenterMembership requires groupId from a Group construct.");
-    }
-    if (props.groupMembers.length === 0) {
-        throw new Error("IdentityCenterMembership requires at least one member email. Empty groups should be skipped at the caller.");
-    }
-    const seen = new Set();
-    for (const member of props.groupMembers) {
-        if (!member.includes("@")) {
-            throw new Error(`IdentityCenterMembership: "${member}" is not a valid email — Identity Center memberships look up users by UserName (email)`);
-        }
-        if (seen.has(member)) {
-            throw new Error(`Duplicate member "${member}" in IdentityCenterMembership groupMembers.`);
-        }
-        seen.add(member);
-    }
-}
-export class IdentityCenterMembership extends NestedStack {
-    constructor(scope, id, props) {
-        super(scope, id, props);
-        validateIdentityCenterMembershipProps(props);
-        for (const member of props.groupMembers) {
-            const [localPart] = member.split("@");
-            const suffix = stripAndCamelCase(localPart ?? member);
-            const listUsersCall = {
-                service: IDENTITY_STORE_SERVICE,
-                action: "listUsers",
-                parameters: {
-                    IdentityStoreId: props.identityStoreId,
-                    Filters: [
-                        {
-                            AttributePath: "UserName",
-                            AttributeValue: member
-                        }
-                    ]
-                },
-                physicalResourceId: customResources.PhysicalResourceId.of(`listUsers${suffix}`)
-            };
-            const userLookup = new AwsCustomResource(this, `User${suffix}`, {
-                onCreate: listUsersCall,
-                onUpdate: listUsersCall
-            });
-            const userId = userLookup.getResponseField("Users.0.UserId");
-            new GroupMembership(this, `Membership${suffix}`, {
-                identityStoreId: props.identityStoreId,
-                groupId: props.groupId,
-                userId
-            });
-        }
-    }
-}

package/dist/lib/layers/layers/secrets-resolver/bin/resolve-secrets

@@ -1,30 +0,0 @@
-#!/bin/bash
-# Fjall Secrets Resolver Wrapper
-#
-# Invoked by AWS_LAMBDA_EXEC_WRAPPER before the Lambda runtime starts.
-# Calls the Node.js resolver to fetch secrets from the AWS Parameters and
-# Secrets Extension, then execs into the original runtime bootstrap.
-#
-# The resolver outputs `export KEY='value'` lines which we eval to inject
-# secrets as environment variables visible to the handler.
-
-set -euo pipefail
-
-# Only run resolver if secrets are configured
-if [ -n "${SSM_SECRET_NAMES:-}" ] || env | grep -q '_SECRET_ARN='; then
-  RESOLVER_OUTPUT=$(/var/lang/bin/node /opt/bin/resolve-secrets.mjs)
-  if [ -n "$RESOLVER_OUTPUT" ]; then
-    # Validate each line matches `export NAME='...'` before eval to prevent
-    # accidental code execution if the resolver ever emits unexpected output
-    while IFS= read -r line; do
-      if [[ "$line" =~ ^export\ [a-zA-Z_][a-zA-Z0-9_]*= ]]; then
-        eval "$line"
-      else
-        echo "[fjall-resolver] Unexpected output from resolver: ${line:0:80}" >&2
-        exit 1
-      fi
-    done <<< "$RESOLVER_OUTPUT"
-  fi
-fi
-
-exec "$@"

package/dist/lib/layers/layers/secrets-resolver/bin/resolve-secrets.mjs

@@ -1,212 +0,0 @@
-/**
- * Fjall Secrets Resolver — runs before Lambda handler via AWS_LAMBDA_EXEC_WRAPPER.
- *
- * Resolves secrets from two sources using the AWS Parameters and Secrets Extension
- * HTTP cache at localhost:2773:
- *
- * 1. SSM Parameter Store (user-managed secrets via `fjall secrets set`)
- *    Reads SSM_SECRETS_PATH + SSM_SECRET_NAMES, fetches each parameter,
- *    exports as environment variables.
- *
- * 2. Secrets Manager (CDK-managed secrets, e.g. database credentials)
- *    Scans for *_SECRET_ARN env vars, fetches each secret,
- *    optionally extracts a JSON field via the matching *_SECRET_FIELD var,
- *    exports as the prefix (e.g. DATABASE_PASSWORD_SECRET_ARN → DATABASE_PASSWORD).
- *
- * Outputs `export KEY='value'` lines to stdout. The bash wrapper evals this output
- * and then execs into the Lambda runtime.
- *
- * The Extension may not be ready immediately during INIT phase, so all HTTP
- * calls use a retry loop with exponential backoff.
- */
-
-const EXTENSION_PORT = process.env.PARAMETERS_SECRETS_EXTENSION_HTTP_PORT || "2773";
-const EXTENSION_URL = `http://localhost:${EXTENSION_PORT}`;
-const MAX_RETRIES = 5;
-const INITIAL_DELAY_MS = 100;
-/** Per-request timeout — generous for localhost; total budget bounded by Lambda INIT timeout */
-const REQUEST_TIMEOUT_MS = 2000;
-
-/**
- * Fetch from the Extension HTTP API with retry and exponential backoff.
- * The Extension starts during INIT phase 1 (Extension init) and the wrapper
- * runs during INIT phase 2 (Runtime init), so it is usually ready — but
- * a retry loop handles the timing edge case.
- */
-async function fetchWithRetry(path) {
-  let delay = INITIAL_DELAY_MS;
-  let lastError;
-
-  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-    try {
-      const response = await fetch(`${EXTENSION_URL}${path}`, {
-        headers: {
-          "X-Aws-Parameters-Secrets-Token": process.env.AWS_SESSION_TOKEN,
-        },
-        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-      });
-      if (response.ok) {
-        return await response.json();
-      }
-      // 4xx errors (e.g. secret not found) — don't retry
-      if (response.status >= 400 && response.status < 500) {
-        const body = await response.text().catch(() => "");
-        const err = new Error(`Extension returned ${response.status}: ${body}`);
-        err.nonRetriable = true;
-        throw err;
-      }
-      // 5xx — retriable
-      const body = await response.text().catch(() => "");
-      lastError = new Error(`Extension returned ${response.status}: ${body}`);
-    } catch (err) {
-      if (err.nonRetriable) {
-        throw err;
-      }
-      lastError = err;
-    }
-
-    // Retry with backoff (both 5xx and network errors)
-    if (attempt < MAX_RETRIES - 1) {
-      await new Promise((r) => setTimeout(r, delay));
-      delay *= 2;
-    }
-  }
-
-  throw new Error(
-    `Failed to reach Extension after ${MAX_RETRIES} attempts: ${lastError?.message}`,
-  );
-}
-
-/**
- * Escape a value for safe inclusion in a shell `export KEY='value'` statement.
- * Single-quotes are the safest quoting mechanism — only embedded single-quotes
- * need escaping via the close-reopen pattern: ' → '\''
- */
-function shellEscape(value) {
-  return "'" + value.replace(/'/g, "'\\''") + "'";
-}
-
-// POSIX env var names: letters, digits, underscores; must not start with a digit
-const VALID_ENV_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-
-function assertValidEnvName(name, source) {
-  if (!VALID_ENV_NAME.test(name)) {
-    process.stderr.write(
-      `[fjall-resolver] Invalid env var name '${name}' from ${source}. ` +
-        `Names must match [a-zA-Z_][a-zA-Z0-9_]* (no dots or hyphens).\n`,
-    );
-    process.exit(1);
-  }
-}
-
-/**
- * Resolve SSM Parameter Store secrets.
- * Reads SSM_SECRETS_PATH and SSM_SECRET_NAMES, fetches each SecureString parameter.
- */
-async function resolveSsmSecrets() {
-  const basePath = process.env.SSM_SECRETS_PATH;
-  const secretNames = process.env.SSM_SECRET_NAMES;
-
-  if (!basePath || !secretNames) return [];
-
-  const names = secretNames.split(",").filter(Boolean);
-  const exports = [];
-
-  for (const name of names) {
-    assertValidEnvName(name, "SSM_SECRET_NAMES");
-    const paramPath = `${basePath}/${name}`;
-    const encodedPath = encodeURIComponent(paramPath);
-
-    try {
-      const data = await fetchWithRetry(
-        `/systemsmanager/parameters/get?name=${encodedPath}&withDecryption=true`,
-      );
-      const value = data?.Parameter?.Value;
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${name}=${shellEscape(value)}`);
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        `[fjall-resolver] Failed to resolve SSM parameter ${paramPath}: ${msg}\n`,
-      );
-      process.exit(1);
-    }
-  }
-
-  return exports;
-}
-
-/**
- * Resolve Secrets Manager secrets.
- * Scans for *_SECRET_ARN env vars, fetches each secret from SM,
- * optionally extracts a JSON field, and exports as the prefix.
- */
-async function resolveSecretsManagerSecrets() {
-  const exports = [];
-
-  for (const [key, arn] of Object.entries(process.env)) {
-    if (!key.endsWith("_SECRET_ARN") || !arn) continue;
-
-    const prefix = key.slice(0, -"_SECRET_ARN".length);
-    assertValidEnvName(prefix, "Secrets Manager");
-    const fieldKey = `${prefix}_SECRET_FIELD`;
-    const field = process.env[fieldKey];
-
-    const encodedArn = encodeURIComponent(arn);
-
-    try {
-      const data = await fetchWithRetry(
-        `/secretsmanager/get?secretId=${encodedArn}`,
-      );
-
-      let value;
-      if (field && data?.SecretString) {
-        let parsed;
-        try {
-          parsed = JSON.parse(data.SecretString);
-        } catch {
-          throw new Error(
-            `Secret is not valid JSON but field '${field}' was requested. Store the secret as a JSON object.`,
-          );
-        }
-        value = parsed[field];
-        if (value === undefined) {
-          throw new Error(
-            `Field '${field}' not found in secret (${Object.keys(parsed).length} fields present).`,
-          );
-        }
-      } else {
-        value = data?.SecretString;
-      }
-
-      if (value !== undefined && value !== null) {
-        exports.push(`export ${prefix}=${shellEscape(String(value))}`);
-      }
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      process.stderr.write(
-        `[fjall-resolver] Failed to resolve SM secret ${prefix} (${arn}): ${msg}\n`,
-      );
-      process.exit(1);
-    }
-  }
-
-  return exports;
-}
-
-async function main() {
-  const ssmExports = await resolveSsmSecrets();
-  const smExports = await resolveSecretsManagerSecrets();
-  const allExports = [...ssmExports, ...smExports];
-
-  if (allExports.length > 0) {
-    process.stdout.write(allExports.join("\n") + "\n");
-  }
-}
-
-main().catch((err) => {
-  const msg = err instanceof Error ? err.message : String(err);
-  process.stderr.write(`[fjall-resolver] Fatal error: ${msg}\n`);
-  process.exit(1);
-});