@fjall/components-infrastructure 9.0.0 → 10.1.2

package/dist/lib/patterns/aws/computeEcsTypes.d.ts

@@ -117,7 +117,10 @@ export interface EcsContainerConfig {
     essential?: boolean;
     /**
      * Health check configuration.
-     * Default: For primary container with port, uses curl health check.
+     * Default: none — the construct emits no container health check unless one
+     * is declared here. Without one (and without an ALB target group), ECS
+     * treats the container as healthy from the moment it is RUNNING, so
+     * post-start exits are invisible to the deployment circuit breaker.
      */
     healthCheck?: {
         command: string[];
@@ -252,6 +255,35 @@ export type EcsHookMigrationsConfig = EcsLifecycleHookMigrationsConfig | EcsPost
  * etc. on the narrowed object.
  */
 export declare function isHookMigrations(config: EcsMigrationsConfig): config is EcsHookMigrationsConfig;
+/**
+ * Object form of the `schemaGate` service knob. See the `schemaGate` JSDoc
+ * on `EcsServiceConfig` for the semantics of each field.
+ */
+export interface EcsSchemaGateConfig {
+    /**
+     * Materialise the synthetic `fjall-schema-gate` container. Defaults
+     * `true`. `false` keeps env injection but restores the pre-10.x
+     * behaviour where the app's own boot gate is the sole enforcement.
+     */
+    materialise?: boolean;
+    /**
+     * Override the gate image URI. Defaults to the release-pinned
+     * `@fjall/schema-gate` image mirrored into the target account's private
+     * ECR by the deploy engine.
+     */
+    image?: string;
+}
+/**
+ * Collapse the `boolean | EcsSchemaGateConfig` knob into its three
+ * independent answers. One decode site — every consumer (env resolution,
+ * materialisation, validation) reads the same normalised shape rather than
+ * re-deriving the union's semantics.
+ */
+export declare function normaliseSchemaGate(schemaGate: boolean | EcsSchemaGateConfig | undefined): {
+    envInjection: boolean;
+    materialise: boolean;
+    image: string | undefined;
+};
 /**
  * `mode: "init-container"` variant — migration runs as a non-essential init
  * container inside each replica's task, dependsOn `COMPLETE` before main starts.
@@ -442,6 +474,19 @@ export interface EcsCircuitBreakerConfig {
      * trips. Defaults to `true`.
      */
     rollback?: boolean;
+    /**
+     * Whether one healthy task resets the breaker's failure counter. Defaults
+     * to `false` — deliberately stricter than AWS's `true` default, where a
+     * slow crash loop that occasionally boots a task can hold a deployment
+     * `IN_PROGRESS` indefinitely.
+     */
+    resetOnHealthyTask?: boolean;
+    /**
+     * Absolute failed-task count before the breaker trips (CFN
+     * `ThresholdConfiguration { Type: COUNT }`). Omitted → ECS computes its
+     * default from the desired count. Must be a positive integer.
+     */
+    threshold?: number;
 }
 /**
  * ECS scaling configuration.
@@ -497,6 +542,29 @@ export interface EcsScheduledTaskConfig {
     cpu: number;
     memoryLimitMiB: number;
     command?: string[];
+    /**
+     * Plain (non-secret) env vars for the task's container. Framework-resolved
+     * schema-version gate env (from a migrated database in `connections`) merges
+     * BENEATH these — author values win, mirroring the service-container
+     * semantics in `buildContainerConfigs`.
+     */
+    environment?: Record<string, string>;
+    /**
+     * Connections to data resources — the same connector interface services
+     * use. Produces IAM grants on the task role, security-group wiring (via the
+     * cluster's EC2 capacity security group — scheduled tasks run on the
+     * cluster's instances), and schema-version gate env injection when a
+     * connected database declares `migrations:`. Scheduled tasks never
+     * materialise a `fjall-schema-gate` container; only the env is injected —
+     * the task's own entrypoint decides whether to gate on it.
+     */
+    connections?: ConnectionSpec[];
+    /**
+     * Set `false` to opt the task out of schema-version gate env injection.
+     * Scheduled tasks never materialise a gate container, so unlike the
+     * service-level knob only the boolean form applies here.
+     */
+    schemaGate?: boolean;
     /** Container secrets (Secrets Manager / SSM) — same shape as ECS `secrets`. */
     secrets?: Record<string, EcsSecret>;
     /** Pre-existing CDK log group. Mutually exclusive with `logRetention`. */
@@ -608,6 +676,19 @@ export interface EcsServiceConfig {
      * For multi-container services, the first container with a port is the primary container.
      */
     containers?: EcsContainerConfig[];
+    /**
+     * Service intent. `"web"` (the default when omitted) may declare container
+     * ports and ALB routing. `"worker"` is a background service with no inbound
+     * surface — a container `port`/`portMappings` or service `routing` on a
+     * worker is rejected at synth, so the declared intent cannot drift from the
+     * shape. Declaring it changes nothing else: portless services already skip
+     * ALB attachment, and no container health check is ever injected by
+     * default (see `EcsContainerConfig.healthCheck`). Without a declared health
+     * check the deployment circuit breaker cannot see a worker that starts and
+     * then exits or wedges — declare one on workers whose liveness should gate
+     * deployments.
+     */
+    serviceType?: "web" | "worker";
     /**
      * Routing rules for this service on the cluster's ALB.
      * Required when cluster has multiple services with ports.
@@ -692,20 +773,36 @@ export interface EcsServiceConfig {
      */
     connections?: ConnectionSpec[];
     /**
-     * Schema-version gate opt-out. Defaults `true`.
+     * Schema-version gate configuration. Defaults `true` (fully on).
      *
      * When any database in `connections` carries a `migrations` block, every
      * container in this service receives `EXPECTED_SCHEMA_VERSION` resolved
-     * from that database's migration tool at synth time. Set `false` to skip
-     * the injection — intended for sidecars that intentionally tolerate
-     * schema drift or one-shot maintenance tasks.
+     * from that database's migration tool at synth time, AND — when the
+     * service is eligible — a synthetic `fjall-schema-gate` container is
+     * materialised that verifies the live database BEFORE any app container
+     * starts (`dependsOn: SUCCESS`), so a schema refusal stops the task
+     * pre-RUNNING and trips the deployment circuit breaker instead of
+     * crash-looping invisibly.
+     *
+     * - `false` — everything off: no env injection, no materialised gate.
+     *   Intended for sidecars that intentionally tolerate schema drift or
+     *   one-shot maintenance tasks.
+     * - `{ materialise: false }` — env injection only (the pre-10.x
+     *   behaviour): the app's own boot gate remains the sole enforcement.
+     * - `{ image: "…" }` — bring-your-own gate image URI (endpoint-only
+     *   VPCs that cannot reach the mirrored default, or a custom runner).
+     *
+     * Materialisation auto-disables (with a synth warning) when the gate
+     * cannot verify the target: non-`prisma` migration tools, non-postgres
+     * engine families, and `migrations.mode: "post-deploy"` (where the
+     * expected version is deliberately ahead of the database at scale-up).
      *
      * Named opt-out is auditable: grep-recoverable across the monorepo. Note
      * the spelling collision with `@fjall/generator`'s codemod pipeline gate
      * at `validationGate/gates/schema.ts` — different surface, different
      * concept.
      */
-    schemaGate?: boolean;
+    schemaGate?: boolean | EcsSchemaGateConfig;
     /**
      * Cross-app resources reachable via VPC peering. Each entry resolves the
      * peered app's exposed resource at synth time (SSM `valueForStringParameter`
@@ -960,6 +1057,16 @@ export interface EcsComputeProps {
      * Accepts either an ITopic directly or a topic ARN string (resolved internally).
      */
     alertsTopic?: ITopic | string;
+    /**
+     * ECS task-stop watchdog (default on): a per-cluster EventBridge rule
+     * captures abnormal task stops into a 30-day forensic log group
+     * `/fjall/<cluster>/task-stops`, derives
+     * `Fjall/ECS StoppedTaskCount{ClusterName,ServiceName}` via a metric
+     * filter, and (when `alertsTopic` is set) raises a notification-only churn
+     * alarm per service. `false` disables the whole watchdog — auditable
+     * opt-out for cost-sensitive clusters.
+     */
+    taskStopWatchdog?: false;
     /** Application ID for alarm tagging (used by webhook to map alarms to applications). */
     applicationId?: string;
 }

package/dist/lib/patterns/aws/computeEcsTypes.js

@@ -10,3 +10,22 @@ export { ScalingType };
 export function isHookMigrations(config) {
     return config.mode === "lifecycle-hook" || config.mode === "post-deploy";
 }
+/**
+ * Collapse the `boolean | EcsSchemaGateConfig` knob into its three
+ * independent answers. One decode site — every consumer (env resolution,
+ * materialisation, validation) reads the same normalised shape rather than
+ * re-deriving the union's semantics.
+ */
+export function normaliseSchemaGate(schemaGate) {
+    if (schemaGate === false) {
+        return { envInjection: false, materialise: false, image: undefined };
+    }
+    if (schemaGate === true || schemaGate === undefined) {
+        return { envInjection: true, materialise: true, image: undefined };
+    }
+    return {
+        envInjection: true,
+        materialise: schemaGate.materialise !== false,
+        image: schemaGate.image
+    };
+}

package/dist/lib/patterns/aws/computePropApplicability.js

@@ -16,6 +16,7 @@ const COMPUTE_PROP_APPLICABILITY = {
     services: ["ecs"],
     alertsTopic: ["ecs"],
     applicationId: ["ecs"],
+    taskStopWatchdog: ["ecs"],
     deployment: ["lambda"],
     functionUrl: ["lambda"],
     handler: ["lambda"],

package/dist/lib/patterns/aws/database.d.ts

@@ -1,4 +1,5 @@
 import { Construct } from "constructs";
+import { type RemovalPolicy } from "aws-cdk-lib";
 import type { ITopic } from "aws-cdk-lib/aws-sns";
 import type { RdsAlarmThresholds } from "../../resources/aws/monitoring/index.js";
 import type App from "../../app.js";
@@ -6,7 +7,7 @@ import { type DynamoDBKeySchema, type DynamoDBGlobalSecondaryIndex } from "../..
 import { ClickHouseDatabase, type ClickHouseDatabaseProps } from "./clickhouseDatabase.js";
 import { type Connections, type IConnectable, type IVpc } from "aws-cdk-lib/aws-ec2";
 import { type ITable } from "aws-cdk-lib/aws-dynamodb";
-import { type Secret } from "../../resources/aws/secrets/index.js";
+import { type Secret, type SecretImport } from "../../resources/aws/secrets/index.js";
 import { PolicyStatement, type IGrantable, type Grant } from "aws-cdk-lib/aws-iam";
 import { type IRelationalDatabaseBase, type IRelationalInstanceDatabase, type IRelationalClusterDatabase, type IDynamoDBDatabase, type RelationalDatabaseType, type SnapshotTarget, type MigrationsConfig } from "./interfaces/database.js";
 import { type MigrationContributions } from "./interfaces/migrationContributor.js";
@@ -59,6 +60,12 @@ export interface AuroraDatabaseProps extends BaseDatabaseProps {
     databaseEngine?: DatabaseEngine;
     /** Overrides databaseEngine if provided */
     engine?: IClusterEngine;
+    /**
+     * Defaults to SNAPSHOT (final snapshot on delete). DESTROY is reserved for
+     * disposable-data clusters (dev substrates) — delete takes the data with it,
+     * no snapshot, no recovery.
+     */
+    removalPolicy?: RemovalPolicy;
     /**
      * Aurora PostgreSQL version to build the engine at, e.g. `"16.6"`. Overrides
      * the `databaseEngine` default version; ignored when `engine` is supplied.
@@ -294,6 +301,10 @@ export declare class RelationalDatabase extends Construct implements IRelational
     getMigrationSnapshotPolicy(): PolicyStatement;
     getMigrationsConfig(): MigrationsConfig | undefined;
     getExpectedSchemaVersion(): string | undefined;
+    getSchemaGateContribution(): {
+        readonly environment: Record<string, string>;
+        readonly secretsImport: Record<string, SecretImport>;
+    } | undefined;
     /**
      * Migration contributions for a task connecting to this database via
      * `service.connections:`. Returns env (host/port/name + snapshot identifiers

package/dist/lib/patterns/aws/database.js

@@ -12,6 +12,7 @@ import { Port } from "aws-cdk-lib/aws-ec2";
 import { Effect, PolicyStatement } from "aws-cdk-lib/aws-iam";
 import { MIGRATION_SNAPSHOT_NAME_PREFIX } from "./interfaces/database.js";
 import { pickLatestPrismaMigration } from "../../utils/migrationVersionResolvers.js";
+import { SCHEMA_GATE_DB_PASSWORD_ENV, SCHEMA_GATE_DB_URL_BASE_ENV, SCHEMA_GATE_DB_USER_ENV } from "@fjall/util/migration";
 import { DatabaseClusterEngine, DatabaseInstanceEngine, AuroraPostgresEngineVersion, AuroraMysqlEngineVersion, PostgresEngineVersion, MysqlEngineVersion } from "aws-cdk-lib/aws-rds";
 import { Duration } from "aws-cdk-lib";
 export { isAwsManagedKey, isCMKRequested, AWS_MANAGED, USE_CMK } from "../../utils/databaseTypes.js";
@@ -389,6 +390,7 @@ export class RelationalDatabase extends Construct {
             port: props.port,
             databaseInsights: props.databaseInsights,
             deletionProtection: props.deletionProtection,
+            removalPolicy: props.removalPolicy,
             snapshotIdentifier: props.snapshotIdentifier,
             snapshotUsername: props.snapshotUsername,
             allowVpcAccess: props.allowVpcAccess,
@@ -567,6 +569,20 @@ export class RelationalDatabase extends Construct {
         }
         return version;
     }
+    getSchemaGateContribution() {
+        if (this.migrationsConfig === undefined)
+            return undefined;
+        const credentials = this.getCredentials();
+        return {
+            environment: {
+                [SCHEMA_GATE_DB_URL_BASE_ENV]: this.getConnectionString()
+            },
+            secretsImport: {
+                [SCHEMA_GATE_DB_USER_ENV]: credentials.getImport("username"),
+                [SCHEMA_GATE_DB_PASSWORD_ENV]: credentials.getImport("password")
+            }
+        };
+    }
     /**
      * Migration contributions for a task connecting to this database via
      * `service.connections:`. Returns env (host/port/name + snapshot identifiers

package/dist/lib/patterns/aws/devSubstrate.js

@@ -1,4 +1,4 @@
-import { CfnOutput, Duration, Stack, Tags } from "aws-cdk-lib";
+import { CfnOutput, Duration, RemovalPolicy, Stack, Tags } from "aws-cdk-lib";
 import { Port } from "aws-cdk-lib/aws-ec2";
 import { Cluster } from "aws-cdk-lib/aws-ecs";
 import { Repository, TagMutability, TagStatus } from "aws-cdk-lib/aws-ecr";
@@ -164,7 +164,12 @@ export class DevSubstrate extends Construct {
             serverlessV2MinCapacity: DEV_AURORA_DEFAULTS.SERVERLESS_V2_MIN_CAPACITY,
             serverlessV2MaxCapacity: DEV_AURORA_DEFAULTS.SERVERLESS_V2_MAX_CAPACITY,
             serverlessV2AutoPauseDuration: Duration.seconds(DEV_AURORA_DEFAULTS.AUTO_PAUSE_SECONDS),
-            enableDataApi: DEV_AURORA_DEFAULTS.ENABLE_DATA_API
+            enableDataApi: DEV_AURORA_DEFAULTS.ENABLE_DATA_API,
+            // Disposable-data cluster: branch databases are re-seedable from the
+            // owning app, so an explicit substrate destroy must not strand a
+            // protected cluster or a final snapshot behind it.
+            deletionProtection: false,
+            removalPolicy: RemovalPolicy.DESTROY
         }));
         this.#tagFenced(database);
         return database;
@@ -177,7 +182,11 @@ export class DevSubstrate extends Construct {
         const dropBucket = this.app.addStorage(StorageFactory.build(DEV_SUBSTRATE_DROP_ID, {
             stackPlacement: "compute",
             versioned: true,
-            encryption: "AES256"
+            encryption: "AES256",
+            // Pinned rather than env-resolved: the pre-empty marker tag must be
+            // present for deploy-core to empty the drop on explicit destroy, and
+            // sync drops are transient by design.
+            removalPolicy: "DESTROY"
         }));
         this.#tagFenced(dropBucket);
         const eventQueue = this.app.addMessaging(MessagingFactory.build(DEV_SUBSTRATE_EVENTS_ID, {
@@ -242,14 +251,23 @@ export class DevSubstrate extends Construct {
         // Adopt-mode is an import only — no CFN resource, so it carries no fence tags
         // (nor mutability convergence — a pre-BUG-22 adopted repo keeps IMMUTABLE
         // until flipped out-of-band).
-        const slotRepository = props.adoptSlotEcr === true
-            ? Repository.fromRepositoryName(this, slotEcrId, slotEcrRepositoryName)
-            : new Ecr(this, slotEcrId, {
+        let slotRepository;
+        if (props.adoptSlotEcr === true) {
+            slotRepository = Repository.fromRepositoryName(this, slotEcrId, slotEcrRepositoryName);
+            this.#registerAdoptedEcrResidual(slotEcrId, slotEcrRepositoryName);
+        }
+        else {
+            slotRepository = new Ecr(this, slotEcrId, {
                 repositoryName: slotEcrRepositoryName,
                 // Every `fjall dev up` repushes the branch tag; IMMUTABLE breaks the
                 // first same-branch recreate (BUG-22).
-                tagMutability: TagMutability.MUTABLE
+                tagMutability: TagMutability.MUTABLE,
+                // Pinned rather than env-resolved: slot images are rebuildable, and
+                // an explicit substrate destroy must not strand the repo (BUG-5's
+                // orphan-repo wedge on rollback).
+                removalPolicy: "DESTROY"
             });
+        }
         // Buildx registry cache for slot builds, named by the same helper as the app
         // path's `<repo>-cache` so `fjall dev up` derives this URI from the slot repo's
         // without a second wire field. Adopt is gated on its OWN `adoptCacheEcr` flag,
@@ -259,12 +277,16 @@ export class DevSubstrate extends Construct {
         const slotCacheRepositoryName = buildCacheRepositoryName(slotEcrRepositoryName);
         if (props.adoptCacheEcr === true) {
             Repository.fromRepositoryName(this, `${slotEcrId}Cache`, slotCacheRepositoryName);
+            this.#registerAdoptedEcrResidual(`${slotEcrId}Cache`, slotCacheRepositoryName);
         }
         else {
             const slotCacheRepository = new Ecr(this, `${slotEcrId}Cache`, {
                 repositoryName: slotCacheRepositoryName,
                 // buildx overwrites the per-repo cache manifest tag on every export.
-                tagMutability: TagMutability.MUTABLE
+                tagMutability: TagMutability.MUTABLE,
+                // Rebuildable cache blobs; pinned so an explicit destroy reclaims the
+                // repo instead of stranding it behind env resolution.
+                removalPolicy: "DESTROY"
             });
             // Each `mode=max` export orphans the previous manifest's blobs. The
             // dev-deploy role holds no BatchDeleteImage or PutLifecyclePolicy, so this
@@ -365,6 +387,19 @@ export class DevSubstrate extends Construct {
             // the global `<zone>-hosted-zone-id` export, colliding with the owning
             // Domain stack's.
             childZone = PublicHostedZone.fromHostedZoneAttributes(this, DEV_SUBSTRATE_ZONE_ID, { hostedZoneId, zoneName: childZoneName });
+            this.app.getManifestCollector().addResidual({
+                constructPath: `${this.node.path}/${DEV_SUBSTRATE_ZONE_ID}`,
+                resourceType: "AWS::Route53::HostedZone",
+                physicalNameHint: childZoneName,
+                policy: "adopted",
+                destroyDisposition: "survives",
+                reason: "Adopted hosted zone owned by the account Domain deploy — the " +
+                    "substrate destroy leaves the zone, its parent NS delegation, and " +
+                    "any ACM validation CNAMEs in place.",
+                costClass: "fixed-monthly",
+                cleanupHint: "Zone is shared with the owning Domain stack; remove it there if " +
+                    "the domain itself is being retired."
+            });
         }
         else {
             // Create mode: createDelegationRole:false because the PARENT account owns
@@ -478,4 +513,25 @@ export class DevSubstrate extends Construct {
         Tags.of(scope).add(DEV_TAG_KEY, DEV_TAG_VALUE);
         Tags.of(scope).add(DEV_APP_TAG_KEY, this.appId);
     }
+    /**
+     * Adopted ECR repos are imports — CFN cannot delete what it never created,
+     * so an explicit destroy removes them SDK-side (the worker's post-CFN
+     * DeleteRepository sweep), hence `deleted-on-explicit-destroy`.
+     */
+    #registerAdoptedEcrResidual(constructId, repositoryName) {
+        this.app.getManifestCollector().addResidual({
+            constructPath: `${this.node.path}/${constructId}`,
+            resourceType: "AWS::ECR::Repository",
+            physicalNameHint: repositoryName,
+            policy: "adopted",
+            destroyDisposition: "deleted-on-explicit-destroy",
+            reason: "Adopted repository predating this substrate deploy — outside the " +
+                "stack, so CloudFormation cannot delete it; the destroy worker " +
+                "removes it SDK-side.",
+            costClass: "storage",
+            cleanupHint: `If the destroy report shows this repository was not removed, delete ` +
+                `it manually: aws ecr delete-repository --repository-name ` +
+                `${repositoryName} --force`
+        });
+    }
 }

package/dist/lib/patterns/aws/interfaces/database.d.ts

@@ -147,6 +147,25 @@ export interface IRelationalDatabaseBase extends IDatabase, IConnectable, IMigra
      * — fail loud, never silent.
      */
     getExpectedSchemaVersion(): string | undefined;
+    /**
+     * Connection env + credential imports for the synthetic
+     * `fjall-schema-gate` container (the materialised boot gate). Returns the
+     * credential-free connection URL (`SCHEMA_GATE_DB_URL_BASE_ENV`) plus
+     * username/password Secrets-Manager imports, or `undefined` when no
+     * `migrations:` config is declared — without migrations there is nothing
+     * for the gate to verify. Relational mirror of
+     * `IClickHouseDatabase.getSchemaGateContribution()`.
+     *
+     * Distinct from `getMigrationContributions()`: that is the per-migration
+     * task contract (env + secrets + IAM + egress for running migrations);
+     * this is the narrower contract the gate container needs to READ the
+     * migrations metadata table. Injected ONLY into the gate container —
+     * app containers keep their own connection wiring.
+     */
+    getSchemaGateContribution(): {
+        readonly environment: Record<string, string>;
+        readonly secretsImport: Record<string, SecretImport>;
+    } | undefined;
     /**
      * Grant connect permissions to a grantee.
      * This adds the grantee to the database security group.
@@ -319,6 +338,13 @@ export interface IClickHouseDatabase extends IDatabase, IConnectable, IMigration
         readonly environment: Record<string, string>;
         readonly secretsImport: Record<string, SecretImport>;
     } | undefined;
+    /**
+     * SecretImport for the cluster's CA certificate (raw PEM, no JSON field),
+     * or `undefined` when TLS is disabled (`tls: { mode: "none", … }`).
+     * Consumers wire it under `CLICKHOUSE_CA_CERT` so
+     * `createFjallClickHouseClient()` can verify the chain strictly.
+     */
+    getTlsCaCertImport(): SecretImport | undefined;
     /**
      * Grant connect permissions to a grantee.
      * Adds the grantee to the database security group on both ports.

package/dist/lib/patterns/aws/storage.d.ts

@@ -40,6 +40,13 @@ export interface S3Props {
     readonly deployment?: S3DeploymentConfig;
     /** When true, sets RemovalPolicy.RETAIN (overriding the env-aware default). Used for imported buckets. */
     readonly retain?: boolean;
+    /**
+     * Explicit removal policy, overriding both the env-aware default and the
+     * legacy `retain` flag. DESTROY pins the pre-empty marker tag so deploy-core
+     * empties the bucket on explicit destroy regardless of environment
+     * resolution — required for disposable-data buckets (dev substrates).
+     */
+    readonly removalPolicy?: "DESTROY" | "RETAIN";
     /** Declarative bucket-policy statements appended to the bucket's resource policy. */
     readonly resourcePolicyStatements?: ResourcePolicyStatement[];
 }

package/dist/lib/patterns/aws/storage.js

@@ -38,6 +38,18 @@ function toCorsRules(cors) {
         ...(rule.maxAge !== undefined && { maxAge: rule.maxAge })
     }));
 }
+/**
+ * Explicit `removalPolicy` wins over the legacy `retain` flag; when neither is
+ * set, returns undefined so {@link S3Bucket} applies its env-aware default.
+ */
+function resolveStorageRemovalPolicy(props) {
+    if (props.removalPolicy !== undefined) {
+        return props.removalPolicy === "DESTROY"
+            ? RemovalPolicy.DESTROY
+            : RemovalPolicy.RETAIN;
+    }
+    return props.retain ? RemovalPolicy.RETAIN : undefined;
+}
 export function validateStorageProps(props) {
     if (props.encryption === "KMS" && !props.kmsKeyArn) {
         FjallLogger.warn("'encryption' is set to 'KMS' but 'kmsKeyArn' is not provided. " +
@@ -58,6 +70,7 @@ export class Storage extends Construct {
         const encryptionKey = props.kmsKeyArn
             ? Key.fromKeyArn(this, `${id}KmsKey`, props.kmsKeyArn)
             : undefined;
+        const removalPolicy = resolveStorageRemovalPolicy(props);
         this.bucket = new S3Bucket(this, `${id}Bucket`, {
             bucketName: props.bucketName,
             // The bucket nests one level below, so its own id is `${id}Bucket` — the
@@ -71,7 +84,7 @@ export class Storage extends Construct {
             websiteHosting: props.websiteHosting,
             resourcePolicyStatements: props.resourcePolicyStatements,
             ...(props.cors && { cors: toCorsRules(props.cors) }),
-            ...(props.retain && { removalPolicy: RemovalPolicy.RETAIN })
+            ...(removalPolicy !== undefined && { removalPolicy })
         });
         if (props.deployment) {
             this.bucketDeployment = this.createDeployment(id, props.deployment);

package/dist/lib/resources/aws/compute/applicationLoadBalancer.js

@@ -1,5 +1,7 @@
+import { Duration } from "aws-cdk-lib";
 import { ApplicationLoadBalancer } from "aws-cdk-lib/aws-elasticloadbalancingv2";
 import { SubnetType } from "aws-cdk-lib/aws-ec2";
+import { DEFAULT_ALB_IDLE_TIMEOUT_SECONDS } from "@fjall/util/httpKeepAlive";
 /**
  * Context-free Application Load Balancer factory shared by the ECS cluster path
  * and the dev substrate. Subnet placement is derived from `internetFacing`
@@ -10,6 +12,10 @@ export function createApplicationLoadBalancer(scope, id, options) {
     return new ApplicationLoadBalancer(scope, id, {
         vpc: options.vpc,
         internetFacing: options.internetFacing,
+        // Pinned (rather than left at the AWS default of the same value) because
+        // ALB-fronted containers receive it as FJALL_ALB_IDLE_TIMEOUT_SECONDS
+        // (ecsTaskDefinition.ts) for keep-alive tuning — one constant, both sides.
+        idleTimeout: Duration.seconds(DEFAULT_ALB_IDLE_TIMEOUT_SECONDS),
         ...(options.securityGroup && { securityGroup: options.securityGroup }),
         ...(options.loadBalancerName && {
             loadBalancerName: options.loadBalancerName

package/dist/lib/resources/aws/compute/ecs.d.ts

@@ -89,6 +89,18 @@ export default class EcsCluster extends Construct implements IConnectable {
     registerScheduledTaskDefinition(name: string, taskDefinition: TaskDefinition): void;
     /** Get the ECS cluster construct. */
     getCluster(): CdkCluster;
+    /**
+     * Connectable scoped to the cluster's EC2 capacity security groups alone.
+     * Scheduled tasks run on the cluster's instances (bridge/host networking),
+     * so their network reachability is the instance security groups' — NOT the
+     * per-service groups that `this.connections` aggregates; using the
+     * aggregate would grant every service's group ingress on the peer. All
+     * capacity slots' groups are included because the EventBridge EcsTask
+     * target places tasks unconstrained across capacity providers — a task can
+     * land on any slot's instances. Returns `undefined` for clusters with no
+     * EC2 capacity.
+     */
+    getEc2CapacityConnectable(): IConnectable | undefined;
     /**
      * Get the EC2 instance role for the cluster's ASG (D10). Returns undefined
      * for Fargate-only clusters. Pulled from the shared ASG capacity state.

package/dist/lib/resources/aws/compute/ecs.js

@@ -5,7 +5,7 @@ import { CfnOutput, Aspects } from "aws-cdk-lib";
 import { processConnections } from "../../../utils/connections.js";
 import { stackScopedExportName } from "../../../utils/exportNaming.js";
 import { toPascalCase } from "../../../utils/capitaliseString.js";
-import { createEcsServiceAlarms, createLogPatternAlarms } from "../monitoring/index.js";
+import { createEcsServiceAlarms, createEcsTaskStopWatchdog, createLogPatternAlarms } from "../monitoring/index.js";
 // Extracted modules
 import { CapacityProviderDependencyAspect } from "./ecsCapacityProviderAspect.js";
 import { validateEcsClusterProps } from "./ecsValidation.js";
@@ -69,7 +69,8 @@ export default class EcsCluster extends Construct {
         providers: new Map(),
         asgOrigins: new Map(),
         autoScalingGroup: undefined,
-        asgSecurityGroup: undefined
+        asgSecurityGroup: undefined,
+        asgSecurityGroups: []
     };
     services = new Map();
     scheduledTaskDefinitions = new Map();
@@ -119,6 +120,18 @@ export default class EcsCluster extends Construct {
         for (const serviceProps of props.services) {
             this.addServiceToCluster(serviceProps);
         }
+        if (props.taskStopWatchdog !== false) {
+            createEcsTaskStopWatchdog({
+                scope: this,
+                clusterName: props.clusterName,
+                cluster: this.cluster,
+                serviceNames: props.services
+                    .filter((s) => s.alarms !== false)
+                    .map((s) => s.name),
+                alertsTopic: props.alertsTopic,
+                applicationId: props.applicationId
+            });
+        }
         this.addDeployableServiceOutputs(props);
         this.connections = this.setupConnections(props);
         Aspects.of(this).add(new CapacityProviderDependencyAspect(this.cluster));
@@ -182,6 +195,23 @@ export default class EcsCluster extends Construct {
     getCluster() {
         return this.cluster;
     }
+    /**
+     * Connectable scoped to the cluster's EC2 capacity security groups alone.
+     * Scheduled tasks run on the cluster's instances (bridge/host networking),
+     * so their network reachability is the instance security groups' — NOT the
+     * per-service groups that `this.connections` aggregates; using the
+     * aggregate would grant every service's group ingress on the peer. All
+     * capacity slots' groups are included because the EventBridge EcsTask
+     * target places tasks unconstrained across capacity providers — a task can
+     * land on any slot's instances. Returns `undefined` for clusters with no
+     * EC2 capacity.
+     */
+    getEc2CapacityConnectable() {
+        const groups = this.asgState.asgSecurityGroups;
+        if (groups.length === 0)
+            return undefined;
+        return { connections: new Connections({ securityGroups: [...groups] }) };
+    }
     /**
      * Get the EC2 instance role for the cluster's ASG (D10). Returns undefined
      * for Fargate-only clusters. Pulled from the shared ASG capacity state.

package/dist/lib/resources/aws/compute/ecsImages.js

@@ -3,6 +3,10 @@ import { Repository } from "aws-cdk-lib/aws-ecr";
 import { DEFAULT_ECS_FALLBACK_IMAGE } from "./ecsConstants.js";
 import { getOrCreateImageTagParameter } from "./imageTagParameter.js";
 export function getContainerImage(ctx, serviceName, containerConfig, serviceProps) {
+    if (containerConfig.verbatimImage === true &&
+        typeof containerConfig.image === "string") {
+        return ContainerImage.fromRegistry(containerConfig.image);
+    }
     const imageSource = containerConfig.image || serviceProps.image || ctx.props.ecrRepository;
     if (!imageSource) {
         return ContainerImage.fromRegistry(DEFAULT_ECS_FALLBACK_IMAGE);