@hasna/uptime 0.1.5 → 0.1.7

package/dist/cloud-plan.d.ts

@@ -6,12 +6,16 @@ export interface AwsDeploymentPlanOptions {
     hostname?: string;
     workspaceId?: string;
     vpcId?: string;
-    rdsInstanceId?: string;
     ecrRepository?: string;
     image?: string;
     evidenceBucket?: string;
-    hostedTokenSecretName?: string;
+    hostedSqliteDbPath?: string;
+    runtimePackageVersion?: string;
+    /** @deprecated Postgres is target-state only until the async adapter is implemented. */
+    rdsInstanceId?: string;
+    /** @deprecated Postgres is target-state only until the async adapter is implemented. */
     databaseSecretName?: string;
+    hostedTokenSecretName?: string;
     appEnvSecretName?: string;
     publicProbeSecretName?: string;
     privateProbeSecretName?: string;
@@ -19,7 +23,7 @@ export interface AwsDeploymentPlanOptions {
 }
 export interface AwsDeploymentPlan {
     kind: "open-uptime.aws-deployment-plan";
-    version: 1;
+    version: 2;
     generatedAt: string;
     status: "blocked";
     canApply: false;
@@ -32,10 +36,13 @@ export interface AwsDeploymentPlan {
     mode: "hosted";
     resources: {
         ecrRepository: string;
+        imageBuilder: string;
         ecsCluster: string;
         services: AwsServicePlan[];
         vpcId: string;
-        rdsInstanceId: string;
+        efsFileSystem: string;
+        efsAccessPoint: string;
+        hostedSqliteDbPath: string;
         evidenceBucket: string;
         loadBalancer: string;
         targetGroups: string[];
@@ -47,9 +54,18 @@ export interface AwsDeploymentPlan {
     image: {
         repository: string;
         uri: string;
+        dockerfile: string;
         buildCommand: string;
         pushCommands: string[];
     };
+    infra: {
+        path: string;
+        fmtCommand: string;
+        initCommand: string;
+        validateCommand: string;
+        planCommand: string;
+        applyAllowed: false;
+    };
     runbook: {
         preflight: string[];
         provision: string[];
@@ -70,6 +86,7 @@ export interface AwsServicePlan {
     name: string;
     role: "web" | "scheduler" | "public-probe" | "reporter" | "migration";
     desiredCount: number;
+    targetDesiredCount: number;
     taskRole: string;
     executionRole: string;
     logGroup: string;

package/dist/cloud-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-plan.d.ts","sourceRoot":"","sources":["../src/cloud-plan.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,eAAe,EAAE,KAAK,CAAC;QACvB,gBAAgB,EAAE,KAAK,CAAC;QACxB,wBAAwB,EAAE,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE;QACN,gBAAgB,EAAE,KAAK,CAAC;QACxB,WAAW,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAWD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,wBAA6B,GAAG,iBAAiB,CA4JhG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CA2DnG;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CASnE"}
+{"version":3,"file":"cloud-plan.d.ts","sourceRoot":"","sources":["../src/cloud-plan.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,eAAe,EAAE,KAAK,CAAC;QACvB,gBAAgB,EAAE,KAAK,CAAC;QACxB,wBAAwB,EAAE,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,kCAAkC,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE;QACN,gBAAgB,EAAE,KAAK,CAAC;QACxB,WAAW,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAWD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,wBAA6B,GAAG,iBAAiB,CAgLhG;AAED,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CA2DnG;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CASnE"}

package/dist/cloud-plan.js

@@ -1,13 +1,13 @@
 // @bun
 // src/cloud-plan.ts
-var DEFAULT_ACCOUNT = "hasna-xyz-infra";
+var DEFAULT_ACCOUNT = "aws-profile";
 var DEFAULT_REGION = "us-east-1";
 var DEFAULT_STAGE = "prod";
 var DEFAULT_PREFIX = "open-uptime";
-var DEFAULT_HOSTNAME = "uptime.hasna.xyz";
-var DEFAULT_WORKSPACE_ID = "wks_2tyysw05cwap";
-var DEFAULT_VPC_ID = "vpc-04c7f7abc1d3c3f56";
-var DEFAULT_RDS = "hasna-xyz-infra-apps-prod-postgres";
+var DEFAULT_HOSTNAME = "uptime.example.com";
+var DEFAULT_WORKSPACE_ID = "workspace-id";
+var DEFAULT_VPC_ID = "vpc-xxxxxxxx";
+var DEFAULT_HOSTED_SQLITE_DB = "/data/uptime/uptime.db";
 function buildAwsDeploymentPlan(options = {}) {
   const region = clean(options.region, DEFAULT_REGION);
   const stage = clean(options.stage, DEFAULT_STAGE);
@@ -15,36 +15,39 @@ function buildAwsDeploymentPlan(options = {}) {
   const accountName = clean(options.accountName, DEFAULT_ACCOUNT);
   const hostname = clean(options.hostname, DEFAULT_HOSTNAME);
   const workspaceId = clean(options.workspaceId, DEFAULT_WORKSPACE_ID);
-  const ecrRepository = clean(options.ecrRepository, `hasna/opensource/${prefix}`);
-  const image = clean(options.image, `<account-id>.dkr.ecr.${region}.amazonaws.com/${ecrRepository}:<git-sha>`);
+  const ecrRepository = clean(options.ecrRepository, prefix);
+  const imageRepositoryUri = `<account-id>.dkr.ecr.${region}.amazonaws.com/${ecrRepository}`;
+  const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
+  const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.7");
   const cluster = `${prefix}-${stage}`;
   const secrets = {
-    database: clean(options.databaseSecretName, `hasna/xyz/opensource/uptime/${stage}/rds`),
-    appEnv: clean(options.appEnvSecretName, `hasna/xyz/opensource/uptime/${stage}/app/env`),
-    hostedToken: clean(options.hostedTokenSecretName, `hasna/xyz/opensource/uptime/${stage}/hosted-token`),
-    publicProbe: clean(options.publicProbeSecretName, `hasna/xyz/opensource/uptime/${stage}/probe/public`),
-    privateProbe: clean(options.privateProbeSecretName, `hasna/xyz/opensource/uptime/${stage}/probe/private`),
-    reporting: clean(options.reportingSecretName, `hasna/xyz/opensource/uptime/${stage}/reporting`)
+    appEnv: clean(options.appEnvSecretName, `open-uptime/${stage}/app/env`),
+    hostedToken: clean(options.hostedTokenSecretName, `open-uptime/${stage}/hosted-token`),
+    publicProbe: clean(options.publicProbeSecretName, `open-uptime/${stage}/probe/public`),
+    privateProbe: clean(options.privateProbeSecretName, `open-uptime/${stage}/probe/private`),
+    reporting: clean(options.reportingSecretName, `open-uptime/${stage}/reporting`)
   };
   const services = [
-    servicePlan(prefix, stage, "web", 2, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "web", 1, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
+      HASNA_UPTIME_HOSTED_SQLITE_DB: hostedSqliteDbPath,
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_HOSTNAME: hostname
     }),
-    servicePlan(prefix, stage, "scheduler", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "scheduler", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "scheduler"
     }),
-    servicePlan(prefix, stage, "public-probe", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "public-probe", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "public-probe",
       HASNA_UPTIME_PROBE_LOCATION: region
     }),
-    servicePlan(prefix, stage, "reporter", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "reporter", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "reporter"
@@ -57,7 +60,7 @@ function buildAwsDeploymentPlan(options = {}) {
   ];
   return {
     kind: "open-uptime.aws-deployment-plan",
-    version: 1,
+    version: 2,
     generatedAt: new Date().toISOString(),
     status: "blocked",
     canApply: false,
@@ -70,10 +73,13 @@ function buildAwsDeploymentPlan(options = {}) {
     mode: "hosted",
     resources: {
       ecrRepository,
+      imageBuilder: `${prefix}-${stage}-image-builder`,
       ecsCluster: cluster,
       services,
       vpcId: clean(options.vpcId, DEFAULT_VPC_ID),
-      rdsInstanceId: clean(options.rdsInstanceId, DEFAULT_RDS),
+      efsFileSystem: `${prefix}-${stage}-data`,
+      efsAccessPoint: `${prefix}-${stage}-uptime`,
+      hostedSqliteDbPath,
       evidenceBucket,
       loadBalancer: `${prefix}-${stage}-alb`,
       targetGroups: [`${prefix}-${stage}-web-tg`],
@@ -82,42 +88,54 @@ function buildAwsDeploymentPlan(options = {}) {
         `${prefix}-${stage}-web-sg`,
         `${prefix}-${stage}-scheduler-sg`,
         `${prefix}-${stage}-public-probe-sg`,
-        `${prefix}-${stage}-rds-client-sg`
+        `${prefix}-${stage}-reporter-sg`,
+        `${prefix}-${stage}-migration-sg`,
+        `${prefix}-${stage}-efs-sg`
       ],
       secrets,
       logGroups: services.map((service) => service.logGroup),
       alarms: [
         `${prefix}-${stage}-web-5xx`,
-        `${prefix}-${stage}-scheduler-stalled`,
-        `${prefix}-${stage}-probe-stale`,
-        `${prefix}-${stage}-report-delivery-failures`
+        `${prefix}-${stage}-web-unhealthy`
       ]
     },
     image: {
       repository: ecrRepository,
       uri: image,
-      buildCommand: "BLOCKED: add a reviewed Dockerfile/container build target before running docker build",
+      dockerfile: "Dockerfile.package",
+      buildCommand: `BLOCKED: after infra approval, AWS CodeBuild builds Dockerfile.package from @hasna/uptime@${runtimePackageVersion} into ${imageRepositoryUri}`,
       pushCommands: [
-        "BLOCKED: push only from approved CI/CD after the ECR repository and image digest policy exist",
+        `BLOCKED: start ${prefix}-${stage}-image-builder only through the approved deploy pipeline after @hasna/uptime@${runtimePackageVersion} is published`,
         "BLOCKED: deploy services by immutable image digest, not by mutable tags"
       ]
     },
+    infra: {
+      path: "infra/aws",
+      fmtCommand: "terraform -chdir=infra/aws fmt -check",
+      initCommand: "terraform -chdir=infra/aws init -backend=false",
+      validateCommand: "terraform -chdir=infra/aws validate",
+      planCommand: "terraform -chdir=infra/aws plan -out open-uptime.tfplan",
+      applyAllowed: false
+    },
     runbook: {
       preflight: [
         `aws sts get-caller-identity --profile ${accountName}`,
-        `aws rds describe-db-instances --db-instance-identifier ${clean(options.rdsInstanceId, DEFAULT_RDS)} --region ${region}`,
         `aws ec2 describe-vpcs --vpc-ids ${clean(options.vpcId, DEFAULT_VPC_ID)} --region ${region}`,
+        `aws efs describe-file-systems --region ${region}`,
         "Confirm the infra repository and Terraform/CloudFormation owner before live mutation."
       ],
       provision: [
         `Infra PR must declare or update ECR repository ${ecrRepository}.`,
+        `Infra PR must declare CodeBuild image builder ${prefix}-${stage}-image-builder for @hasna/uptime@${runtimePackageVersion}.`,
         `Infra PR must declare hardened S3 evidence bucket ${evidenceBucket} with KMS, versioning, lifecycle, and public access block.`,
+        `Infra PR must declare encrypted EFS ${prefix}-${stage}-data with access point, mount targets, and AWS Backup plan.`,
         `Infra PR must declare ECS/Fargate cluster ${cluster}, ALB, target groups, security groups, IAM roles, CloudWatch log groups, and Secrets Manager refs.`,
         "Only apply the infra plan from the approved infrastructure repository after review evidence is attached."
       ],
       deploy: [
         "Build and publish the image only after the Dockerfile/container target is reviewed.",
-        "Run the migration task with the migrator role before web/scheduler/probe services.",
+        `Start the AWS image builder for @hasna/uptime@${runtimePackageVersion} and record the pushed image digest.`,
+        "For the EFS SQLite bridge, do not run migration, scheduler, public-probe, or reporter tasks; keep them at desired count 0 until Postgres and cloud leases exist.",
         `Register task definitions for ${services.map((service) => service.name).join(", ")} using valueFrom secrets.`,
         `Update ECS services in cluster ${cluster} one component at a time through the approved deploy pipeline.`,
         `Create Route53/edge record for ${hostname} only after ALB health checks pass and auth denial smokes succeed.`
@@ -126,7 +144,7 @@ function buildAwsDeploymentPlan(options = {}) {
         "Keep previous task definition ARNs before each service update.",
         "Rollback through the approved deploy pipeline to the previously recorded task definition ARNs.",
         "Disable scheduler/reporter services before data rollback.",
-        "Restore RDS snapshot only after explicit operator approval and audit record."
+        "Restore EFS backup recovery point only after explicit operator approval and audit record."
       ],
       spark01: [
         "Create a private probe identity with a caller-managed public key.",
@@ -135,19 +153,19 @@ function buildAwsDeploymentPlan(options = {}) {
       ]
     },
     blockers: [
-      "The hasna-xyz-infra infrastructure owner repository was not found in this workspace.",
-      "The repo has no reviewed Dockerfile/container build target for image build and publish automation.",
-      "Hosted Postgres storage adapter and migrations are not implemented.",
+      "The infrastructure owner repository was not found in this workspace.",
+      "The EFS SQLite bridge is single-writer only: web target desired count is 1 and scheduler/public-probe/reporter targets remain 0 until Postgres and cloud leases exist.",
       "Hosted production auth/RBAC must replace broad static hosted-token operation before exposure.",
       "Public probe execution still needs DNS, redirect, and rebinding SSRF enforcement plus cloud check-job leases.",
       "Spark01 hosted probe enrollment, claim, submit, heartbeat, revocation, and rotation are not cloud-backed yet."
     ],
     requiredEvidence: [
       "Infrastructure PR/synth/plan from the approved infra repository.",
-      "Container build smoke and immutable image digest.",
+      "CodeBuild image-builder run, container smoke, and immutable image digest.",
       "ECS task definitions using secrets.valueFrom only.",
-      "ALB/TLS/DNS/auth denial smokes.",
-      "RDS TLS, backups/PITR, scoped roles, and migration dry-run evidence.",
+      "ALB/TLS/DNS/auth denial smokes and web alarm checks.",
+      "Single-writer ECS evidence: one web task maximum and no scheduler/public-probe/reporter EFS mounts.",
+      "EFS encryption, access point, mount-target, AWS Backup, and restore-drill evidence.",
       "S3 bucket KMS, versioning, lifecycle, and public-access-block evidence.",
       "Spark01 private-probe registration, key-file mode, heartbeat, and revocation evidence."
     ],
@@ -157,7 +175,9 @@ function buildAwsDeploymentPlan(options = {}) {
       hostedLocalSqliteAllowed: false,
       notes: [
         "This plan generator does not call AWS.",
-        "Hosted runtime must use Postgres; SQLite remains local/dev fallback only.",
+        "Blocked plan output intentionally avoids copy-pastable AWS mutation commands.",
+        "Hosted runtime uses explicit EFS-backed SQLite at HASNA_UPTIME_HOSTED_SQLITE_DB until the async Postgres adapter exists.",
+        "Do not set HASNA_UPTIME_DATABASE_URL for hosted tasks until the Postgres adapter is implemented.",
         "Secrets are represented as secret names/refs and must be injected with valueFrom.",
         "Actual deploy belongs in the deploy_release_operate_final goal node after infra review."
       ]
@@ -218,7 +238,7 @@ function buildSpark01CloudConfig(options = {}) {
       privateKeyInline: false,
       tokenInline: false,
       notes: [
-        "This config is cloud-primary: Spark01 submits to hosted API state instead of local SQLite.",
+        "This config is hosted-targeted preflight: Spark01 must not start until cloud probe routes are backed by hosted state.",
         "The private key file path is referenced, not embedded.",
         "Hosted token or probe auth material must come from the machine secret store, not this generated config."
       ]
@@ -239,7 +259,8 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
   return {
     name,
     role,
-    desiredCount,
+    desiredCount: 0,
+    targetDesiredCount: desiredCount,
     taskRole: `${name}-task-role`,
     executionRole: `${prefix}-${stage}-execution-role`,
     logGroup: `/ecs/${name}`,
@@ -248,7 +269,7 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
       HASNA_UPTIME_IMAGE: image,
       ...environment
     },
-    secrets: role === "public-probe" ? { DATABASE_URL: secrets.database, PROBE_CONFIG: secrets.publicProbe } : role === "reporter" ? { DATABASE_URL: secrets.database, REPORTING_CONFIG: secrets.reporting } : { DATABASE_URL: secrets.database, APP_ENV: secrets.appEnv }
+    secrets: role === "web" ? { APP_ENV: secrets.appEnv, HASNA_UPTIME_HOSTED_TOKEN: secrets.hostedToken } : role === "public-probe" ? { PROBE_CONFIG: secrets.publicProbe } : role === "reporter" ? { REPORTING_CONFIG: secrets.reporting } : { APP_ENV: secrets.appEnv }
   };
 }
 function clean(value, fallback) {

package/dist/index.js

@@ -820,10 +820,12 @@ function ensureUptimeHome() {
 }
 
 // src/store.ts
-import { copyFileSync, existsSync, mkdirSync as mkdirSync2, statSync } from "fs";
+import { copyFileSync, existsSync, mkdirSync as mkdirSync2, statfsSync, statSync } from "fs";
 import { dirname, join as join2 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 import { Database } from "bun:sqlite";
+var DEFAULT_HOSTED_SQLITE_DB_PATH = "/data/uptime/uptime.db";
+var NFS_SUPER_MAGIC = 26985;
 var SECRET_URL_PARAM_PATTERN = /(token|secret|password|passwd|api[_-]?key|access[_-]?token|auth|credential|session)/i;
 var REQUIRED_TABLES = [
   "schema_migrations",
@@ -860,18 +862,39 @@ class UptimeStore {
     this.mode = resolveRuntimeMode(options.mode ?? "local");
     const cloudDatabaseUrl = options.cloudDatabaseUrl ?? process.env.HASNA_UPTIME_DATABASE_URL;
     if (this.mode === "hosted" && cloudDatabaseUrl) {
-      throw new Error("hosted cloud database adapter is not implemented yet");
+      throw new Error("hosted Postgres adapter is not implemented yet; use HASNA_UPTIME_HOSTED_SQLITE_DB on cloud-mounted storage for the current hosted deployment path");
     }
-    if (this.mode === "hosted" && !allowHostedLocalStore(options.allowHostedLocalStore)) {
-      throw new Error("hosted mode requires a cloud data layer; set HASNA_UPTIME_ALLOW_HOSTED_LOCAL_STORE=1 only for explicit local fallback testing");
+    const hostedSqliteDbPath = options.hostedSqliteDbPath ?? process.env.HASNA_UPTIME_HOSTED_SQLITE_DB;
+    if (this.mode === "hosted" && hostedSqliteDbPath) {
+      if (hostedSqliteDbPath === ":memory:" || !hostedSqliteDbPath.startsWith("/")) {
+        throw new Error("HASNA_UPTIME_HOSTED_SQLITE_DB must be an absolute path on mounted cloud storage");
+      }
+      const approvedHostedPath = hostedSqliteDbPath === DEFAULT_HOSTED_SQLITE_DB_PATH;
+      if (!approvedHostedPath && !allowHostedLocalStore(options.allowHostedLocalStore)) {
+        throw new Error(`HASNA_UPTIME_HOSTED_SQLITE_DB must be ${DEFAULT_HOSTED_SQLITE_DB_PATH}; set HASNA_UPTIME_ALLOW_HOSTED_LOCAL_STORE=1 only for explicit local fallback testing`);
+      }
+      const verifiedCloudMount = approvedHostedPath && isNfsMount(dirname(hostedSqliteDbPath));
+      if (approvedHostedPath && !verifiedCloudMount && !allowHostedLocalStore(options.allowHostedLocalStore)) {
+        throw new Error(`${DEFAULT_HOSTED_SQLITE_DB_PATH} must be on a mounted EFS/NFS filesystem; refusing to create hosted task-local SQLite`);
+      }
+      this.dataMode = verifiedCloudMount ? "hosted-efs-sqlite" : "hosted-local-sqlite";
+      this.dbPath = hostedSqliteDbPath;
+    } else if (this.mode === "hosted") {
+      if (!allowHostedLocalStore(options.allowHostedLocalStore)) {
+        throw new Error("hosted mode requires HASNA_UPTIME_HOSTED_SQLITE_DB on mounted cloud storage; set HASNA_UPTIME_ALLOW_HOSTED_LOCAL_STORE=1 only for explicit local fallback testing");
+      }
+      this.dataMode = "hosted-local-sqlite";
+      this.dbPath = options.dbPath ?? uptimeHostedFallbackDbPath();
+    } else {
+      this.dataMode = "local-sqlite";
+      this.dbPath = options.dbPath ?? uptimeDbPath();
     }
-    this.dataMode = this.mode === "hosted" ? "hosted-local-sqlite" : "local-sqlite";
-    this.dbPath = options.dbPath ?? (this.mode === "hosted" ? uptimeHostedFallbackDbPath() : uptimeDbPath());
-    if (this.dbPath !== ":memory:") {
+    if (this.dbPath !== ":memory:" && this.dataMode !== "hosted-efs-sqlite") {
       mkdirSync2(dirname(this.dbPath), { recursive: true });
     }
     this.db = new Database(this.dbPath, { create: true });
-    this.db.run("PRAGMA journal_mode = WAL");
+    this.db.run(this.dataMode === "hosted-efs-sqlite" ? "PRAGMA journal_mode = DELETE" : "PRAGMA journal_mode = WAL");
+    this.db.run("PRAGMA busy_timeout = 5000");
     this.db.run("PRAGMA foreign_keys = ON");
     this.migrate();
   }
@@ -1751,6 +1774,13 @@ function resolveRuntimeMode(mode) {
 function allowHostedLocalStore(value) {
   return value === true || process.env.HASNA_UPTIME_ALLOW_HOSTED_LOCAL_STORE === "1";
 }
+function isNfsMount(path) {
+  try {
+    return statfsSync(path).type === NFS_SUPER_MAGIC;
+  } catch {
+    return false;
+  }
+}
 function verifyBackupFile(backupPath) {
   const db = new Database(backupPath, { readonly: true });
   try {
@@ -3791,14 +3821,14 @@ class ApiError extends Error {
 }
 
 // src/cloud-plan.ts
-var DEFAULT_ACCOUNT = "hasna-xyz-infra";
+var DEFAULT_ACCOUNT = "aws-profile";
 var DEFAULT_REGION = "us-east-1";
 var DEFAULT_STAGE = "prod";
 var DEFAULT_PREFIX = "open-uptime";
-var DEFAULT_HOSTNAME = "uptime.hasna.xyz";
-var DEFAULT_WORKSPACE_ID = "wks_2tyysw05cwap";
-var DEFAULT_VPC_ID = "vpc-04c7f7abc1d3c3f56";
-var DEFAULT_RDS = "hasna-xyz-infra-apps-prod-postgres";
+var DEFAULT_HOSTNAME = "uptime.example.com";
+var DEFAULT_WORKSPACE_ID = "workspace-id";
+var DEFAULT_VPC_ID = "vpc-xxxxxxxx";
+var DEFAULT_HOSTED_SQLITE_DB = "/data/uptime/uptime.db";
 function buildAwsDeploymentPlan(options = {}) {
   const region = clean(options.region, DEFAULT_REGION);
   const stage = clean(options.stage, DEFAULT_STAGE);
@@ -3806,36 +3836,39 @@ function buildAwsDeploymentPlan(options = {}) {
   const accountName = clean(options.accountName, DEFAULT_ACCOUNT);
   const hostname = clean(options.hostname, DEFAULT_HOSTNAME);
   const workspaceId = clean(options.workspaceId, DEFAULT_WORKSPACE_ID);
-  const ecrRepository = clean(options.ecrRepository, `hasna/opensource/${prefix}`);
-  const image = clean(options.image, `<account-id>.dkr.ecr.${region}.amazonaws.com/${ecrRepository}:<git-sha>`);
+  const ecrRepository = clean(options.ecrRepository, prefix);
+  const imageRepositoryUri = `<account-id>.dkr.ecr.${region}.amazonaws.com/${ecrRepository}`;
+  const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
+  const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.7");
   const cluster = `${prefix}-${stage}`;
   const secrets = {
-    database: clean(options.databaseSecretName, `hasna/xyz/opensource/uptime/${stage}/rds`),
-    appEnv: clean(options.appEnvSecretName, `hasna/xyz/opensource/uptime/${stage}/app/env`),
-    hostedToken: clean(options.hostedTokenSecretName, `hasna/xyz/opensource/uptime/${stage}/hosted-token`),
-    publicProbe: clean(options.publicProbeSecretName, `hasna/xyz/opensource/uptime/${stage}/probe/public`),
-    privateProbe: clean(options.privateProbeSecretName, `hasna/xyz/opensource/uptime/${stage}/probe/private`),
-    reporting: clean(options.reportingSecretName, `hasna/xyz/opensource/uptime/${stage}/reporting`)
+    appEnv: clean(options.appEnvSecretName, `open-uptime/${stage}/app/env`),
+    hostedToken: clean(options.hostedTokenSecretName, `open-uptime/${stage}/hosted-token`),
+    publicProbe: clean(options.publicProbeSecretName, `open-uptime/${stage}/probe/public`),
+    privateProbe: clean(options.privateProbeSecretName, `open-uptime/${stage}/probe/private`),
+    reporting: clean(options.reportingSecretName, `open-uptime/${stage}/reporting`)
   };
   const services = [
-    servicePlan(prefix, stage, "web", 2, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "web", 1, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
+      HASNA_UPTIME_HOSTED_SQLITE_DB: hostedSqliteDbPath,
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_HOSTNAME: hostname
     }),
-    servicePlan(prefix, stage, "scheduler", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "scheduler", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "scheduler"
     }),
-    servicePlan(prefix, stage, "public-probe", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "public-probe", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "public-probe",
       HASNA_UPTIME_PROBE_LOCATION: region
     }),
-    servicePlan(prefix, stage, "reporter", 1, image, workspaceId, secrets, {
+    servicePlan(prefix, stage, "reporter", 0, image, workspaceId, secrets, {
       HASNA_UPTIME_MODE: "hosted",
       HASNA_UPTIME_WORKSPACE_ID: workspaceId,
       HASNA_UPTIME_COMPONENT: "reporter"
@@ -3848,7 +3881,7 @@ function buildAwsDeploymentPlan(options = {}) {
   ];
   return {
     kind: "open-uptime.aws-deployment-plan",
-    version: 1,
+    version: 2,
     generatedAt: new Date().toISOString(),
     status: "blocked",
     canApply: false,
@@ -3861,10 +3894,13 @@ function buildAwsDeploymentPlan(options = {}) {
     mode: "hosted",
     resources: {
       ecrRepository,
+      imageBuilder: `${prefix}-${stage}-image-builder`,
       ecsCluster: cluster,
       services,
       vpcId: clean(options.vpcId, DEFAULT_VPC_ID),
-      rdsInstanceId: clean(options.rdsInstanceId, DEFAULT_RDS),
+      efsFileSystem: `${prefix}-${stage}-data`,
+      efsAccessPoint: `${prefix}-${stage}-uptime`,
+      hostedSqliteDbPath,
       evidenceBucket,
       loadBalancer: `${prefix}-${stage}-alb`,
       targetGroups: [`${prefix}-${stage}-web-tg`],
@@ -3873,42 +3909,54 @@ function buildAwsDeploymentPlan(options = {}) {
         `${prefix}-${stage}-web-sg`,
         `${prefix}-${stage}-scheduler-sg`,
         `${prefix}-${stage}-public-probe-sg`,
-        `${prefix}-${stage}-rds-client-sg`
+        `${prefix}-${stage}-reporter-sg`,
+        `${prefix}-${stage}-migration-sg`,
+        `${prefix}-${stage}-efs-sg`
       ],
       secrets,
       logGroups: services.map((service) => service.logGroup),
       alarms: [
         `${prefix}-${stage}-web-5xx`,
-        `${prefix}-${stage}-scheduler-stalled`,
-        `${prefix}-${stage}-probe-stale`,
-        `${prefix}-${stage}-report-delivery-failures`
+        `${prefix}-${stage}-web-unhealthy`
       ]
     },
     image: {
       repository: ecrRepository,
       uri: image,
-      buildCommand: "BLOCKED: add a reviewed Dockerfile/container build target before running docker build",
+      dockerfile: "Dockerfile.package",
+      buildCommand: `BLOCKED: after infra approval, AWS CodeBuild builds Dockerfile.package from @hasna/uptime@${runtimePackageVersion} into ${imageRepositoryUri}`,
       pushCommands: [
-        "BLOCKED: push only from approved CI/CD after the ECR repository and image digest policy exist",
+        `BLOCKED: start ${prefix}-${stage}-image-builder only through the approved deploy pipeline after @hasna/uptime@${runtimePackageVersion} is published`,
         "BLOCKED: deploy services by immutable image digest, not by mutable tags"
       ]
     },
+    infra: {
+      path: "infra/aws",
+      fmtCommand: "terraform -chdir=infra/aws fmt -check",
+      initCommand: "terraform -chdir=infra/aws init -backend=false",
+      validateCommand: "terraform -chdir=infra/aws validate",
+      planCommand: "terraform -chdir=infra/aws plan -out open-uptime.tfplan",
+      applyAllowed: false
+    },
     runbook: {
       preflight: [
         `aws sts get-caller-identity --profile ${accountName}`,
-        `aws rds describe-db-instances --db-instance-identifier ${clean(options.rdsInstanceId, DEFAULT_RDS)} --region ${region}`,
         `aws ec2 describe-vpcs --vpc-ids ${clean(options.vpcId, DEFAULT_VPC_ID)} --region ${region}`,
+        `aws efs describe-file-systems --region ${region}`,
         "Confirm the infra repository and Terraform/CloudFormation owner before live mutation."
       ],
       provision: [
         `Infra PR must declare or update ECR repository ${ecrRepository}.`,
+        `Infra PR must declare CodeBuild image builder ${prefix}-${stage}-image-builder for @hasna/uptime@${runtimePackageVersion}.`,
         `Infra PR must declare hardened S3 evidence bucket ${evidenceBucket} with KMS, versioning, lifecycle, and public access block.`,
+        `Infra PR must declare encrypted EFS ${prefix}-${stage}-data with access point, mount targets, and AWS Backup plan.`,
         `Infra PR must declare ECS/Fargate cluster ${cluster}, ALB, target groups, security groups, IAM roles, CloudWatch log groups, and Secrets Manager refs.`,
         "Only apply the infra plan from the approved infrastructure repository after review evidence is attached."
       ],
       deploy: [
         "Build and publish the image only after the Dockerfile/container target is reviewed.",
-        "Run the migration task with the migrator role before web/scheduler/probe services.",
+        `Start the AWS image builder for @hasna/uptime@${runtimePackageVersion} and record the pushed image digest.`,
+        "For the EFS SQLite bridge, do not run migration, scheduler, public-probe, or reporter tasks; keep them at desired count 0 until Postgres and cloud leases exist.",
         `Register task definitions for ${services.map((service) => service.name).join(", ")} using valueFrom secrets.`,
         `Update ECS services in cluster ${cluster} one component at a time through the approved deploy pipeline.`,
         `Create Route53/edge record for ${hostname} only after ALB health checks pass and auth denial smokes succeed.`
@@ -3917,7 +3965,7 @@ function buildAwsDeploymentPlan(options = {}) {
         "Keep previous task definition ARNs before each service update.",
         "Rollback through the approved deploy pipeline to the previously recorded task definition ARNs.",
         "Disable scheduler/reporter services before data rollback.",
-        "Restore RDS snapshot only after explicit operator approval and audit record."
+        "Restore EFS backup recovery point only after explicit operator approval and audit record."
       ],
       spark01: [
         "Create a private probe identity with a caller-managed public key.",
@@ -3926,19 +3974,19 @@ function buildAwsDeploymentPlan(options = {}) {
       ]
     },
     blockers: [
-      "The hasna-xyz-infra infrastructure owner repository was not found in this workspace.",
-      "The repo has no reviewed Dockerfile/container build target for image build and publish automation.",
-      "Hosted Postgres storage adapter and migrations are not implemented.",
+      "The infrastructure owner repository was not found in this workspace.",
+      "The EFS SQLite bridge is single-writer only: web target desired count is 1 and scheduler/public-probe/reporter targets remain 0 until Postgres and cloud leases exist.",
       "Hosted production auth/RBAC must replace broad static hosted-token operation before exposure.",
       "Public probe execution still needs DNS, redirect, and rebinding SSRF enforcement plus cloud check-job leases.",
       "Spark01 hosted probe enrollment, claim, submit, heartbeat, revocation, and rotation are not cloud-backed yet."
     ],
     requiredEvidence: [
       "Infrastructure PR/synth/plan from the approved infra repository.",
-      "Container build smoke and immutable image digest.",
+      "CodeBuild image-builder run, container smoke, and immutable image digest.",
       "ECS task definitions using secrets.valueFrom only.",
-      "ALB/TLS/DNS/auth denial smokes.",
-      "RDS TLS, backups/PITR, scoped roles, and migration dry-run evidence.",
+      "ALB/TLS/DNS/auth denial smokes and web alarm checks.",
+      "Single-writer ECS evidence: one web task maximum and no scheduler/public-probe/reporter EFS mounts.",
+      "EFS encryption, access point, mount-target, AWS Backup, and restore-drill evidence.",
       "S3 bucket KMS, versioning, lifecycle, and public-access-block evidence.",
       "Spark01 private-probe registration, key-file mode, heartbeat, and revocation evidence."
     ],
@@ -3948,7 +3996,9 @@ function buildAwsDeploymentPlan(options = {}) {
       hostedLocalSqliteAllowed: false,
       notes: [
         "This plan generator does not call AWS.",
-        "Hosted runtime must use Postgres; SQLite remains local/dev fallback only.",
+        "Blocked plan output intentionally avoids copy-pastable AWS mutation commands.",
+        "Hosted runtime uses explicit EFS-backed SQLite at HASNA_UPTIME_HOSTED_SQLITE_DB until the async Postgres adapter exists.",
+        "Do not set HASNA_UPTIME_DATABASE_URL for hosted tasks until the Postgres adapter is implemented.",
         "Secrets are represented as secret names/refs and must be injected with valueFrom.",
         "Actual deploy belongs in the deploy_release_operate_final goal node after infra review."
       ]
@@ -4009,7 +4059,7 @@ function buildSpark01CloudConfig(options = {}) {
       privateKeyInline: false,
       tokenInline: false,
       notes: [
-        "This config is cloud-primary: Spark01 submits to hosted API state instead of local SQLite.",
+        "This config is hosted-targeted preflight: Spark01 must not start until cloud probe routes are backed by hosted state.",
         "The private key file path is referenced, not embedded.",
         "Hosted token or probe auth material must come from the machine secret store, not this generated config."
       ]
@@ -4030,7 +4080,8 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
   return {
     name,
     role,
-    desiredCount,
+    desiredCount: 0,
+    targetDesiredCount: desiredCount,
     taskRole: `${name}-task-role`,
     executionRole: `${prefix}-${stage}-execution-role`,
     logGroup: `/ecs/${name}`,
@@ -4039,7 +4090,7 @@ function servicePlan(prefix, stage, role, desiredCount, image, workspaceId, secr
       HASNA_UPTIME_IMAGE: image,
       ...environment
     },
-    secrets: role === "public-probe" ? { DATABASE_URL: secrets.database, PROBE_CONFIG: secrets.publicProbe } : role === "reporter" ? { DATABASE_URL: secrets.database, REPORTING_CONFIG: secrets.reporting } : { DATABASE_URL: secrets.database, APP_ENV: secrets.appEnv }
+    secrets: role === "web" ? { APP_ENV: secrets.appEnv, HASNA_UPTIME_HOSTED_TOKEN: secrets.hostedToken } : role === "public-probe" ? { PROBE_CONFIG: secrets.publicProbe } : role === "reporter" ? { REPORTING_CONFIG: secrets.reporting } : { APP_ENV: secrets.appEnv }
   };
 }
 function clean(value, fallback) {