@raindancers/raindancers-crew 0.0.0 → 0.0.2

package/.jsii

@@ -9030,7 +9030,7 @@
   },
   "name": "@raindancers/raindancers-crew",
   "readme": {
-    "markdown": "# @raindancers/raindancers-crew\n\nA CDK construct that provisions a **self-hosted [KiroCrew](https://github.com/kirodotdev/KiroCrew) gateway** on a single EC2 instance in your own AWS account, reached over **SSM Session Manager** — no inbound ports, no SSH key.\n\nIt is a pipeline-native, version-controlled port of the upstream `kirocrew-ec2` CloudFormation template. Where the native `kirocrew cloud launch` is an imperative one-shot, this construct lets you deploy the same shape **through your own CDK pipeline**, under **your** naming, permissions boundary, and OIDC deploy role — so a remote crew becomes a reviewed, repeatable, diffable artifact like everything else you ship.\n\n## Getting started\n\n### 1. Install\n\n```bash\nnpm install @raindancers/raindancers-crew\n```\n\nThe package targets `aws-cdk-lib` ^2.260.0 and `constructs` ^10 (peer dependencies — your app supplies them).\n\n### 2. Define a stack\n\nA complete stack that stands up an EC2 crew with off-box backup. Everything is\ntyped and compiles as-is — fill in your account, region, VPC lookup, and\npermissions-boundary ARN.\n\n```ts\nimport { App, Stack, StackProps } from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { Construct } from 'constructs';\nimport {\n  RemoteCrewInstance,\n  CrewArchitecture,\n  CrewBackupBucket,\n} from '@raindancers/raindancers-crew';\n\nclass CrewStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps) {\n    super(scope, id, props);\n\n    // Your existing VPC (or ec2.Vpc.fromLookup(...)).\n    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true });\n\n    // Durable, versioned, KMS-encrypted backup destination.\n    const backup = new CrewBackupBucket(this, 'CrewBackup');\n\n    new RemoteCrewInstance(this, 'Crew', {\n      vpc,\n      // REQUIRED: the instance runs a prompt-injectable agent, so its role\n      // must be capped by a permissions boundary you pre-create.\n      permissionsBoundaryArn:\n        'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n      architecture: CrewArchitecture.ARM64,\n      instanceType: new ec2.InstanceType('m7g.2xlarge'),\n      // Pin a released tag for reproducible deploys — the default `main` drifts.\n      source: { kirocrewRef: 'v0.8.0' },\n      // Off-box backup: grants scoped write + installs a daily snapshot timer.\n      backupBucket: backup,\n      backupSchedule: 'daily',\n    });\n  }\n}\n\nconst app = new App();\nnew CrewStack(app, 'RemoteCrew', {\n  env: { account: '123456789012', region: 'eu-west-2' },\n});\napp.synth();\n```\n\n### 3. Deploy through your pipeline\n\nThis is a plain CDK stack — deploy it however you deploy everything else\n(a CDK Pipelines / agentl stage, or `cdk deploy` from a keyless-OIDC CI job).\nThe `WaitCondition` blocks stack completion until the gateway is actually\nserving, so a green deploy means a live crew (and a failed bootstrap rolls the\nstack back with the setup-log tail in the failure reason).\n\n```bash\ncdk deploy RemoteCrew\n```\n\n### 4. Connect\n\nAccess is **SSM-only** — no inbound ports. Open a port-forward to the\nloopback dashboard and browse `http://127.0.0.1:5476`:\n\n```bash\n# The construct exports the instance id under a stable name derived from the\n# stackTag (default 'kirocrew'): kirocrew-<stackTag>-instance-id\nINSTANCE_ID=$(aws cloudformation list-exports \\\n  --query \"Exports[?Name=='kirocrew-kirocrew-instance-id'].Value\" --output text)\n\naws ssm start-session --target \"$INSTANCE_ID\" \\\n  --document-name AWS-StartPortForwardingSession \\\n  --parameters '{\"portNumber\":[\"5476\"],\"localPortNumber\":[\"5476\"]}'\n```\n\n(Or use the upstream `kirocrew cloud connect`, which mints the dashboard token\non the box and opens the tunnel for you.)\n\n### 5. Verify backup\n\nThe daily timer pushes a redaction-scrubbed snapshot to the backup bucket. Fire\none immediately and confirm it landed:\n\n```bash\n# On the instance (via SSM Session Manager):\nsudo systemctl start kirocrew-backup.service\nsudo journalctl -u kirocrew-backup.service --no-pager | tail\n\n# From your workstation — the stable key a replacement instance restores from:\naws s3 ls \"s3://<backup-bucket>/crew-snapshots/latest.tar\"\n```\n\nTo rebuild a **replacement** instance from backup, deploy a fresh `CrewStack`\npointing at the same bucket, then on the new box run\n`sudo kirocrew-restore-from-s3` (pulls `latest.tar`, stops the gateway,\nrestores in replace mode, restarts).\n\n> **Container crew instead of an instance?** See [Fargate lane](#fargate-lane)\n> below — swap `RemoteCrewInstance` for `FargateCrewBase` + `FargateCrew`.\n\nThe sections below are the per-construct reference.\n\n## What it creates\n\n| Resource | Notes |\n|---|---|\n| IAM role + instance profile | `AmazonSSMManagedInstanceCore` + a **required permissions boundary**; scoped `s3:GetObject` only when an S3 source is used |\n| Security group | **No inbound** by default (SSM-only); optional `tcp/22` from `allowSshCidr` (≤ /16); optional webhook port from a single source SG via `webhookIngress`; IPv6 egress when `enableIpv6` |\n| EC2 instance | Amazon Linux 2023, arch-aware AMI, **IMDSv2 enforced**, **encrypted gp3** root |\n| WaitConditionHandle + WaitCondition | Blocks stack completion until the gateway is actually serving on the loopback dashboard port |\n\n## Security posture (preserved from upstream)\n\n- **SSM-only access.** No inbound rules unless you explicitly pass `allowSshCidr`. Access is via SSM port-forward; the public DNS is diagnostics only.\n- **IMDSv2 required, hop limit 1.** KiroCrew runs a prompt-injectable agent that executes arbitrary tools — an SSRF/injection reaching the metadata endpoint must not be able to read the role's STS credentials via IMDSv1.\n- **Permissions boundary is mandatory** on the instance role.\n- **Node.js tarball is SHA-256-pinned** and verified before root extraction.\n- **Encrypted EBS root.**\n\n## Private dual-stack brain (55minutes posture)\n\nFor an always-on brain that egresses over IPv6 with **no public IPv4**, is woken\nby the native KiroCrew webhook, and runs as an autopilot crew that never\nidle-closes, compose the additive props below. Everything here is optional and\ndefaults off — omit it all and you get the SSM-only public-subnet box above.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { RemoteCrewInstance, CrewArchitecture } from '@raindancers/raindancers-crew';\n\n// vpc: a dual-stack VPC whose private subnets carry IPv6 CIDRs and route\n//      ::/0 to an Egress-Only Internet Gateway (see \"What stays yours\" below).\n// ingestLambdaSg: the SG of the consumer's ingest Lambda / reverse proxy —\n//      imported, this construct never creates it.\nnew RemoteCrewInstance(this, 'Brain', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  architecture: CrewArchitecture.ARM64,\n  source: { kirocrewRef: 'v0.8.0' },\n\n  // Private + dual-stack: IPv6 egress, no public IPv4.\n  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n  associatePublicIp: false,\n  enableIpv6: true,\n\n  // Webhook reach from ONE source SG only (never a CIDR), authenticated by a\n  // Bearer token fetched from Secrets Manager at boot (written to config.json\n  // as hooks.webhook_token; the instance role gets GetSecretValue on this ARN).\n  webhookIngress: { source: ingestLambdaSg },\n  webhookTokenSecretArn:\n    'arn:aws:secretsmanager:eu-west-2:123456789012:secret:kc/webhook-token-AbCdEf',\n\n  // Always-on: autopilot + never idle-close.\n  crewRuntime: { autopilot: true, disableIdleClose: true },\n});\n```\n\n### What stays yours (this construct provisions none of it)\n\n`RemoteCrewInstance` consumes an `IVpc` and provisions no routing, so these live\nin your VPC / app, not the library:\n\n- **Egress-Only Internet Gateway** and the `::/0` IPv6 egress route — the VPC's\n  concern. `enableIpv6` assigns the instance an IPv6 address and opens IPv6\n  egress on its SG, but the route to the internet is yours.\n- **fck-nat (or managed NAT)** for any IPv4 egress you still need.\n- **The ingest Lambda and its security group** — you build it and pass its SG as\n  `webhookIngress.source`. The construct only accepts it.\n- **Routable exposure of the webhook.** The KiroCrew gateway binds `127.0.0.1`\n  only (it has no routable listener), so `webhookIngress` opens the SG but a\n  **consumer-owned reverse proxy or SSH tunnel on the box** is what actually\n  forwards `POST /api/hooks/agent` from the source SG to the loopback gateway.\n  The dashboard stays loopback/SSM-only regardless.\n\n## Connecting\n\n`RemoteCrewInstance` provisions the box; **connection stays an operator action** (it is inherently imperative — mint a short-lived token on the instance and open an SSM port-forward). Use the upstream `kirocrew cloud connect` against the deployed instance id, or your own SSM `start-session` / port-forward wrapper.\n\n## Fargate lane\n\nFor a container-based crew there are two sibling constructs, mirroring the upstream `kirocrew-fargate-base` + `kirocrew-fargate-crew` split:\n\n- **`FargateCrewBase`** — one per account/region: the ECS cluster crew tasks run on plus an egress-only (no-inbound) task security group. Deleting a crew must not delete the shared cluster, so this is separate.\n- **`FargateCrew`** — one per crew: the execution role (secret read scoped to `kirocrew/crew/<crew>/*`, log write, optional private-ECR pull), the **zero-policy task role** (the running container's blast radius — it must never gain `secretsmanager:GetSecretValue`), and the crew's log group. All names are derived from the crew name.\n\n```ts\nimport { FargateCrewBase, FargateCrew } from '@raindancers/raindancers-crew';\n\nconst base = new FargateCrewBase(this, 'CrewBase', { vpc });\nnew FargateCrew(this, 'Crew', {\n  crew: 'fiftyfive',\n  // permissionsBoundaryArn: '...',  // optional until the shared boundary creator lands\n  // ecrRepositoryArn: '...',        // only for a private image; public registry needs no grant\n});\n```\n\nSecurity invariants preserved from upstream: task role has no policies and never reads secrets; execution-role secret read is crew-scoped with individually-listed actions (no prefix wildcards); both assume-role trusts carry an `aws:SourceAccount` condition. The permissions boundary is **optional** here (a declared degraded mode) because no creator for the crew boundary exists yet — unlike the EC2 lane, where it is mandatory.\n\n**EC2 vs Fargate:** EC2 gives a persistent box with local disk (the crew's memory/knowledge DBs live on the instance) and is the native launcher's default; Fargate is more ephemeral and expects external persistence. For a remote crew that remembers across sessions, EC2 is usually the better fit.\n\n## Backing up the crew's learnings\n\nA remote crew's value is its accumulated memory, lessons, and knowledge — which on the EC2 lane live on the instance's local disk. KiroCrew's built-in backup (`kirocrew snapshot`) produces a redaction-scrubbed bundle (the signing key, `.env`, and execution logs never ship), but writes it **locally** — so it survives corruption, not instance loss. These constructs add the missing **off-box durability**.\n\n`CrewBackupBucket` provisions a hardened destination: SSE-KMS (rotating key), all public access blocked, TLS-only, **versioned**, with a lifecycle rule expiring stale noncurrent versions. Bucket and key `RETAIN` on stack delete, so the backups outlive a teardown.\n\n```ts\nimport { CrewBackupBucket, RemoteCrewInstance } from '@raindancers/raindancers-crew';\n\nconst backup = new CrewBackupBucket(this, 'CrewBackup');\n\nnew RemoteCrewInstance(this, 'Crew', {\n  vpc,\n  permissionsBoundaryArn: '...',\n  backupBucket: backup,          // grants scoped write + installs a daily timer\n  backupSchedule: 'daily',       // systemd OnCalendar\n});\n```\n\nOn the **EC2 lane** this grants the instance role scoped write, installs a **systemd timer** that runs `kirocrew snapshot --purpose backup` and uploads the newest bundle to S3 (a timestamped key for history plus a stable `latest.tar`), and installs a `kirocrew-restore-from-s3` helper. On the **Fargate lane**, pass the same bucket to `FargateCrew` — it grants the **task role** (the running container) write, since the container runs its own snapshot push.\n\n### Restore (rebuilding a replacement crew)\n\n`kirocrew restore <bundle> --mode replace|merge`:\n\n- **replace** clears the target's memory/knowledge trees and rebuilds them from the bundle (the knowledge DB and memory stores are replaced wholesale, not row-merged). Restore validates database integrity and refuses a truncated bundle; `sel_hmac.key` is regenerated (not restored). Use on a fresh replacement instance.\n- **merge** layers the bundle onto existing state without clearing. Use to seed a crew you want to keep.\n\nOn an EC2 instance provisioned with a backup bucket, `sudo kirocrew-restore-from-s3` pulls `latest.tar`, stops the gateway, restores in **replace** mode, and restarts — a one-command rebuild.\n\n## License\n\nApache-2.0\n"
+    "markdown": "# @raindancers/raindancers-crew\n\nA CDK construct that provisions a **self-hosted [KiroCrew](https://github.com/kirodotdev/KiroCrew) gateway** on a single EC2 instance in your own AWS account, reached over **SSM Session Manager** — no inbound ports, no SSH key.\n\nIt is a pipeline-native, version-controlled port of the upstream `kirocrew-ec2` CloudFormation template. Where the native `kirocrew cloud launch` is an imperative one-shot, this construct lets you deploy the same shape **through your own CDK pipeline**, under **your** naming, permissions boundary, and OIDC deploy role — so a remote crew becomes a reviewed, repeatable, diffable artifact like everything else you ship.\n\n## Architecture\n\nWhat `RemoteCrewInstance` creates (solid) and what your VPC/app owns (dashed). The default is the SSM-only public-subnet box; the IPv6 egress and webhook ingress are opt-in props.\n\n```mermaid\nflowchart TB\n  subgraph vpc[\"Your VPC (you own routing)\"]\n    subgraph subnet[\"Subnet (public, or private-with-egress)\"]\n      instance[\"EC2 instance<br/>Amazon Linux 2023, IMDSv2<br/>encrypted gp3 root<br/>kirocrew gateway on 127.0.0.1:5476\"]\n      sg[\"Security group<br/>no inbound by default<br/>IPv6 egress if enableIpv6<br/>webhook port if webhookIngress\"]\n      instance --- sg\n    end\n    eigw([\"Egress-Only IGW<br/>(consumer-owned, IPv6)\"])\n    nat([\"NAT / fck-nat<br/>(consumer-owned, IPv4)\"])\n    proxy([\"Reverse proxy<br/>(consumer-owned, fronts loopback webhook)\"])\n  end\n\n  role[\"IAM role<br/>SSM core + required permissions boundary<br/>scoped S3 GetObject / secret GetSecretValue\"]\n  wait[\"WaitCondition<br/>blocks stack until gateway is healthy\"]\n  operator([\"Operator\"])\n  secret[(\"Secrets Manager<br/>webhook Bearer token\")]\n  ingest([\"Ingest Lambda SG<br/>(consumer-owned)\"])\n\n  instance --- role\n  instance -.-> wait\n  operator -- \"SSM port-forward (no inbound)\" --> instance\n  instance -. \"IPv6 egress\" .-> eigw\n  instance -. \"IPv4 egress\" .-> nat\n  ingest -. \"webhook, source-SG only\" .-> proxy -.-> instance\n  instance -. \"fetch token at boot\" .-> secret\n\n  classDef owned fill:#e8f0fe,stroke:#4285f4;\n  classDef consumer fill:#f5f5f5,stroke:#999,stroke-dasharray:4 3;\n  class instance,sg,role,wait owned;\n  class eigw,nat,proxy,ingest,secret consumer;\n```\n\n## Getting started\n\n### 1. Install\n\n```bash\nnpm install @raindancers/raindancers-crew\n```\n\nThe package targets `aws-cdk-lib` ^2.260.0 and `constructs` ^10 (peer dependencies — your app supplies them).\n\n### 2. Define a stack\n\nA complete stack that stands up an EC2 crew with off-box backup. Everything is\ntyped and compiles as-is — fill in your account, region, VPC lookup, and\npermissions-boundary ARN.\n\n```ts\nimport { App, Stack, StackProps } from 'aws-cdk-lib';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { Construct } from 'constructs';\nimport {\n  RemoteCrewInstance,\n  CrewArchitecture,\n  CrewBackupBucket,\n} from '@raindancers/raindancers-crew';\n\nclass CrewStack extends Stack {\n  constructor(scope: Construct, id: string, props: StackProps) {\n    super(scope, id, props);\n\n    // Your existing VPC (or ec2.Vpc.fromLookup(...)).\n    const vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true });\n\n    // Durable, versioned, KMS-encrypted backup destination.\n    const backup = new CrewBackupBucket(this, 'CrewBackup');\n\n    new RemoteCrewInstance(this, 'Crew', {\n      vpc,\n      // REQUIRED: the instance runs a prompt-injectable agent, so its role\n      // must be capped by a permissions boundary you pre-create.\n      permissionsBoundaryArn:\n        'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n      architecture: CrewArchitecture.ARM64,\n      instanceType: new ec2.InstanceType('m7g.2xlarge'),\n      // Pin a released tag for reproducible deploys — the default `main` drifts.\n      source: { kirocrewRef: 'v0.8.0' },\n      // Off-box backup: grants scoped write + installs a daily snapshot timer.\n      backupBucket: backup,\n      backupSchedule: 'daily',\n    });\n  }\n}\n\nconst app = new App();\nnew CrewStack(app, 'RemoteCrew', {\n  env: { account: '123456789012', region: 'eu-west-2' },\n});\napp.synth();\n```\n\n### 3. Deploy through your pipeline\n\nThis is a plain CDK stack — deploy it however you deploy everything else\n(a CDK Pipelines / agentl stage, or `cdk deploy` from a keyless-OIDC CI job).\nThe `WaitCondition` blocks stack completion until the gateway is actually\nserving, so a green deploy means a live crew (and a failed bootstrap rolls the\nstack back with the setup-log tail in the failure reason).\n\n```bash\ncdk deploy RemoteCrew\n```\n\n### 4. Connect\n\nAccess is **SSM-only** — no inbound ports. Open a port-forward to the\nloopback dashboard and browse `http://127.0.0.1:5476`:\n\n```bash\n# The construct exports the instance id under a stable name derived from the\n# stackTag (default 'kirocrew'): kirocrew-<stackTag>-instance-id\nINSTANCE_ID=$(aws cloudformation list-exports \\\n  --query \"Exports[?Name=='kirocrew-kirocrew-instance-id'].Value\" --output text)\n\naws ssm start-session --target \"$INSTANCE_ID\" \\\n  --document-name AWS-StartPortForwardingSession \\\n  --parameters '{\"portNumber\":[\"5476\"],\"localPortNumber\":[\"5476\"]}'\n```\n\n(Or use the upstream `kirocrew cloud connect`, which mints the dashboard token\non the box and opens the tunnel for you.)\n\n### 5. Verify backup\n\nThe daily timer pushes a redaction-scrubbed snapshot to the backup bucket. Fire\none immediately and confirm it landed:\n\n```bash\n# On the instance (via SSM Session Manager):\nsudo systemctl start kirocrew-backup.service\nsudo journalctl -u kirocrew-backup.service --no-pager | tail\n\n# From your workstation — the stable key a replacement instance restores from:\naws s3 ls \"s3://<backup-bucket>/crew-snapshots/latest.tar\"\n```\n\nTo rebuild a **replacement** instance from backup, deploy a fresh `CrewStack`\npointing at the same bucket, then on the new box run\n`sudo kirocrew-restore-from-s3` (pulls `latest.tar`, stops the gateway,\nrestores in replace mode, restarts).\n\n> **Container crew instead of an instance?** See [Fargate lane](#fargate-lane)\n> below — swap `RemoteCrewInstance` for `FargateCrewBase` + `FargateCrew`.\n\nThe sections below are the per-construct reference.\n\n## What it creates\n\n| Resource | Notes |\n|---|---|\n| IAM role + instance profile | `AmazonSSMManagedInstanceCore` + a **required permissions boundary**; scoped `s3:GetObject` only when an S3 source is used |\n| Security group | **No inbound** by default (SSM-only); optional `tcp/22` from `allowSshCidr` (≤ /16); optional webhook port from a single source SG via `webhookIngress`; IPv6 egress when `enableIpv6` |\n| EC2 instance | Amazon Linux 2023, arch-aware AMI, **IMDSv2 enforced**, **encrypted gp3** root |\n| WaitConditionHandle + WaitCondition | Blocks stack completion until the gateway is actually serving on the loopback dashboard port |\n\n## Security posture (preserved from upstream)\n\n- **SSM-only access.** No inbound rules unless you explicitly pass `allowSshCidr`. Access is via SSM port-forward; the public DNS is diagnostics only.\n- **IMDSv2 required, hop limit 1.** KiroCrew runs a prompt-injectable agent that executes arbitrary tools — an SSRF/injection reaching the metadata endpoint must not be able to read the role's STS credentials via IMDSv1.\n- **Permissions boundary is mandatory** on the instance role.\n- **Node.js tarball is SHA-256-pinned** and verified before root extraction.\n- **Encrypted EBS root.**\n\n## Private dual-stack brain (55minutes posture)\n\nFor an always-on brain that egresses over IPv6 with **no public IPv4**, is woken\nby the native KiroCrew webhook, and runs as an autopilot crew that never\nidle-closes, compose the additive props below. Everything here is optional and\ndefaults off — omit it all and you get the SSM-only public-subnet box above.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { RemoteCrewInstance, CrewArchitecture } from '@raindancers/raindancers-crew';\n\n// vpc: a dual-stack VPC whose private subnets carry IPv6 CIDRs and route\n//      ::/0 to an Egress-Only Internet Gateway (see \"What stays yours\" below).\n// ingestLambdaSg: the SG of the consumer's ingest Lambda / reverse proxy —\n//      imported, this construct never creates it.\nnew RemoteCrewInstance(this, 'Brain', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  architecture: CrewArchitecture.ARM64,\n  source: { kirocrewRef: 'v0.8.0' },\n\n  // Private + dual-stack: IPv6 egress, no public IPv4.\n  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n  associatePublicIp: false,\n  enableIpv6: true,\n\n  // Webhook reach from ONE source SG only (never a CIDR), authenticated by a\n  // Bearer token fetched from Secrets Manager at boot (written to config.json\n  // as hooks.webhook_token; the instance role gets GetSecretValue on this ARN).\n  webhookIngress: { source: ingestLambdaSg },\n  webhookTokenSecretArn:\n    'arn:aws:secretsmanager:eu-west-2:123456789012:secret:kc/webhook-token-AbCdEf',\n\n  // Always-on: autopilot + never idle-close.\n  crewRuntime: { autopilot: true, disableIdleClose: true },\n});\n```\n\n### What stays yours (this construct provisions none of it)\n\n`RemoteCrewInstance` consumes an `IVpc` and provisions no routing, so these live\nin your VPC / app, not the library:\n\n- **Egress-Only Internet Gateway** and the `::/0` IPv6 egress route — the VPC's\n  concern. `enableIpv6` assigns the instance an IPv6 address and opens IPv6\n  egress on its SG, but the route to the internet is yours.\n- **fck-nat (or managed NAT)** for any IPv4 egress you still need.\n- **The ingest Lambda and its security group** — you build it and pass its SG as\n  `webhookIngress.source`. The construct only accepts it.\n- **Routable exposure of the webhook.** The KiroCrew gateway binds `127.0.0.1`\n  only (it has no routable listener), so `webhookIngress` opens the SG but a\n  **consumer-owned reverse proxy or SSH tunnel on the box** is what actually\n  forwards `POST /api/hooks/agent` from the source SG to the loopback gateway.\n  The dashboard stays loopback/SSM-only regardless.\n\n## Examples\n\nWorked implementations for the common shapes. Each is a complete construct\ninstantiation against the real props — fill in your account, region, VPC, and\npermissions-boundary ARN.\n\n### 1. Minimal SSM-only crew (the simplest thing that works)\n\nA single crew box in a public subnet, reached only over SSM. No backup, no\nwebhook, defaults everywhere.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { RemoteCrewInstance } from '@raindancers/raindancers-crew';\n\nconst vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true });\n\nnew RemoteCrewInstance(this, 'Crew', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  // Pin a released tag for reproducible deploys — the default `main` drifts.\n  source: { kirocrewRef: 'v0.8.0' },\n});\n```\n\n### 2. Crew with off-box backup\n\nAdd a hardened, versioned, KMS-encrypted backup bucket; the construct grants the\ninstance role write + read and installs a daily snapshot timer.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport {\n  RemoteCrewInstance,\n  CrewBackupBucket,\n  CrewArchitecture,\n} from '@raindancers/raindancers-crew';\n\nconst vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true });\nconst backup = new CrewBackupBucket(this, 'CrewBackup');\n\nnew RemoteCrewInstance(this, 'Crew', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  architecture: CrewArchitecture.ARM64,\n  instanceType: new ec2.InstanceType('m7g.2xlarge'),\n  source: { kirocrewRef: 'v0.8.0' },\n  backupBucket: backup,\n  backupSchedule: 'daily',           // systemd OnCalendar expression\n  backupPrefix: 'crew-snapshots/',\n});\n```\n\n### 3. Source from an S3 tarball instead of a git clone\n\nFor air-gapped or pinned-artifact deploys: the instance role is granted\n`s3:GetObject` on exactly that one object, nothing wider.\n\n```ts\nnew RemoteCrewInstance(this, 'Crew', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  source: {\n    sourceBucket: 'my-artifacts-bucket',\n    sourceKey: 'kirocrew/kirocrew-src-v0.8.0.tar.gz',\n  },\n});\n```\n\n### 4. Private dual-stack always-on brain (the full 55minutes posture)\n\nPrivate subnet, IPv6 egress, no public IPv4, webhook reachable from one source\nSG, authenticated by a Secrets Manager token, running as an autopilot crew that\nnever idle-closes. See [Private dual-stack brain](#private-dual-stack-brain-55minutes-posture)\nabove for the prop-by-prop walkthrough.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport { RemoteCrewInstance, CrewArchitecture } from '@raindancers/raindancers-crew';\n\n// ingestLambdaSg: the SG of your ingest Lambda / reverse proxy — imported.\nnew RemoteCrewInstance(this, 'Brain', {\n  vpc,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-ec2-boundary',\n  architecture: CrewArchitecture.ARM64,\n  source: { kirocrewRef: 'v0.8.0' },\n\n  vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },\n  associatePublicIp: false,\n  enableIpv6: true,\n\n  webhookIngress: { source: ingestLambdaSg },\n  webhookTokenSecretArn:\n    'arn:aws:secretsmanager:eu-west-2:123456789012:secret:kc/webhook-token-AbCdEf',\n\n  crewRuntime: { autopilot: true, disableIdleClose: true },\n});\n```\n\n### 5. Fargate lane — shared base + one crew\n\nFor a container-based crew: `FargateCrewBase` once per account/region (the ECS\ncluster + egress-only SG), then one `FargateCrew` per crew (its two roles + log\ngroup). Deleting a crew never touches the shared cluster.\n\n```ts\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\nimport {\n  FargateCrewBase,\n  FargateCrew,\n  FargateCpuArchitecture,\n  CrewBackupBucket,\n} from '@raindancers/raindancers-crew';\n\nconst vpc = ec2.Vpc.fromLookup(this, 'Vpc', { isDefault: true });\nconst backup = new CrewBackupBucket(this, 'CrewBackup');\n\n// One per account/region — the shared cluster + egress-only task SG.\nconst base = new FargateCrewBase(this, 'CrewBase', {\n  vpc,\n  cpuArchitecture: FargateCpuArchitecture.ARM64,\n});\n\n// One per crew — roles + log group. Task role gets the backup write grant\n// (the running container pushes snapshots), NEVER a secret-read grant.\nconst crew = new FargateCrew(this, 'ResearchCrew', {\n  crew: 'research',\n  logRetentionDays: 30,\n  permissionsBoundaryArn:\n    'arn:aws:iam::123456789012:policy/kirocrew-crew-boundary',\n  backupBucket: backup,\n});\n\n// base.cluster, base.securityGroup, crew.executionRole, crew.taskRole,\n// crew.logGroup, crew.secretNamePrefix are exposed for your RunTask launch spec.\n```\n\n### Access + webhook flow\n\nHow the crew is reached — SSM for the operator, the source-SG + reverse proxy\nfor the native webhook. Nothing dials the box directly.\n\n```mermaid\nsequenceDiagram\n  actor Op as Operator\n  participant SSM as SSM Session Manager\n  participant GW as Gateway (127.0.0.1:5476)\n  Op->>SSM: aws ssm start-session (port-forward)\n  SSM->>GW: tunnel to loopback dashboard\n  GW-->>Op: dashboard on localhost\n\n  participant Src as Ingest Lambda (source SG)\n  participant RP as Reverse proxy (consumer)\n  participant Hook as Gateway /api/hooks/agent (loopback)\n  Src->>RP: POST webhook (SG allows source only)\n  RP->>Hook: forward with Bearer token\n  Hook-->>RP: 202 accepted (agent turn queued)\n```\n\n## Connecting\n\n`RemoteCrewInstance` provisions the box; **connection stays an operator action** (it is inherently imperative — mint a short-lived token on the instance and open an SSM port-forward). Use the upstream `kirocrew cloud connect` against the deployed instance id, or your own SSM `start-session` / port-forward wrapper.\n\n## Fargate lane\n\nFor a container-based crew there are two sibling constructs, mirroring the upstream `kirocrew-fargate-base` + `kirocrew-fargate-crew` split:\n\n- **`FargateCrewBase`** — one per account/region: the ECS cluster crew tasks run on plus an egress-only (no-inbound) task security group. Deleting a crew must not delete the shared cluster, so this is separate.\n- **`FargateCrew`** — one per crew: the execution role (secret read scoped to `kirocrew/crew/<crew>/*`, log write, optional private-ECR pull), the **zero-policy task role** (the running container's blast radius — it must never gain `secretsmanager:GetSecretValue`), and the crew's log group. All names are derived from the crew name.\n\n```ts\nimport { FargateCrewBase, FargateCrew } from '@raindancers/raindancers-crew';\n\nconst base = new FargateCrewBase(this, 'CrewBase', { vpc });\nnew FargateCrew(this, 'Crew', {\n  crew: 'fiftyfive',\n  // permissionsBoundaryArn: '...',  // optional until the shared boundary creator lands\n  // ecrRepositoryArn: '...',        // only for a private image; public registry needs no grant\n});\n```\n\nSecurity invariants preserved from upstream: task role has no policies and never reads secrets; execution-role secret read is crew-scoped with individually-listed actions (no prefix wildcards); both assume-role trusts carry an `aws:SourceAccount` condition. The permissions boundary is **optional** here (a declared degraded mode) because no creator for the crew boundary exists yet — unlike the EC2 lane, where it is mandatory.\n\n**EC2 vs Fargate:** EC2 gives a persistent box with local disk (the crew's memory/knowledge DBs live on the instance) and is the native launcher's default; Fargate is more ephemeral and expects external persistence. For a remote crew that remembers across sessions, EC2 is usually the better fit.\n\n## ECS-on-EC2 multi-crew host\n\n`EcsCrewHost` runs several isolated Kiro Crew instances on ONE self-provisioned EC2 host, each crew as its own ECS-on-EC2 container task. It builds on the same `FargateCrewBase` cluster and `FargateCrew` per-crew identity, adds the EC2 capacity, and wires the two-subnet host-NAT networking. It is strictly additive: `crewCount` defaults to 1, so a plain instantiation behaves like a single crew and existing consumers gain nothing new.\n\n```ts\nimport { EcsCrewHost, CrewBackupBucket } from '@raindancers/raindancers-crew';\nimport * as ec2 from 'aws-cdk-lib/aws-ec2';\n\nconst backup = new CrewBackupBucket(this, 'CrewBackup');\n\nnew EcsCrewHost(this, 'CrewFleet', {\n  vpc,                                  // you supply the two-subnet host-NAT VPC\n  permissionsBoundaryArn: '...',        // host role boundary (required)\n  crewPermissionsBoundaryArn: '...',    // kirocrew-crew-boundary for the crew roles\n  instanceType: new ec2.InstanceType('m9g.xlarge'),\n  crewCount: 3,\n  crewDataVolumeSizeGb: 20,\n  backupBucket: backup,\n  stackTag: 'fiftyfive',\n});\n```\n\nWhat it creates:\n\n| Resource | Notes |\n|---|---|\n| ECS cluster + egress-only task SG | Reused from `FargateCrewBase` (one per account/region) |\n| Size-1 Auto Scaling Group + capacity provider | ONE self-provisioned host, arch-aware ECS-optimized AL2023 AMI, **IMDSv2 enforced**, **encrypted gp3** root. A size-1 ASG is still one EC2 host; the capacity provider is what registers it with the cluster so the L2 `Ec2Service` can schedule onto it |\n| Per-crew EC2 task definition + service | `awsvpc` network mode (each task its own ENI + private IP), `desiredCount: 1`, egress-only task SG, **no public IP**. Reuses each crew's `FargateCrew` task/execution role and `/kirocrew/crew/<crew>` log group |\n| Per-crew durable EBS | one encrypted **gp3** volume per crew, **`deleteOnTermination: false`** so a crew's `~/.kiro/crew` outlives an instance replacement. Resolved in the bootstrap by a stable filesystem **label**, never `/dev/sdf` (the Nitro NVMe layer renames it) |\n| Host role grant | scoped `ec2:ModifyInstanceAttribute` (tag-conditioned to KiroCrew ECS hosts) so the host disables its own source/dest check for NAT |\n\nNetworking model (you supply the VPC; the construct does NOT create a NAT Gateway, fck-nat, VPC endpoints, or an ALB):\n\n- **PUBLIC subnet** holds the host ENI + Elastic IP + the IGW route. The host egresses directly via the IGW.\n- **PRIVATE subnet** holds the crew task ENIs. Its `0.0.0.0/0` route points at the host ENI. The host does the NAT: the bootstrap sets `net.ipv4.ip_forward=1` and an iptables `MASQUERADE` rule, and the host disables source/dest check on its own ENI. Tasks have no public IPs.\n\nIsolation is container-level (shared kernel), accepted as sufficient: Graviton Nitro protects the box from other AWS tenants, and containers cover crew-to-crew separation. Two cautions this bakes into the props and tests:\n\n- **Host-OOM cross-crew blast radius.** Each crew container carries a SOFT `memoryReservationMiB` (for scheduling) and a HARD `memoryLimitMiB` (its ceiling). Hard caps bound each crew, but because the kernel is shared, if the sum of ACTUAL usage exceeds physical RAM the host OOM-killer can hit any crew. For a hard guarantee set the sum of hard caps at or below (physical RAM minus host + ECS-agent headroom). This is the accepted cost of container isolation versus microVMs.\n- **awsvpc ENI budget.** Each task takes one ENI, plus the host ENI, so you need at least `crewCount + 1` ENIs on the instance type. `crewCount` is validated 1..8. The bootstrap enables ENI trunking (`ECS_ENABLE_AWSVPC_TRUNKING`) which raises the per-instance task-ENI budget on smaller sizes; confirm the chosen `m9g` size carries `crewCount + 1` ENIs before you build.\n\n### Optional webhook ingress (`CrewWebhookIngress`)\n\nBecause each task has a real private VPC IP, an in-VPC Lambda can POST to a crew's `POST /api/hooks/agent` directly, with no VPC endpoint. `CrewWebhookIngress` is an OPTIONAL composable sub-construct (mirroring `CrewBackupBucket`): OFF by default, so an existing consumer gains no new resources. When instantiated it creates an SNS topic, an in-VPC arm64 Lambda under the boundary, and the ONE controlled inbound exception to the egress-only task model: a scoped ingress rule on the crew task SG from the Lambda's SG on the crew port only, never a CIDR. It ships no webhook-to-crew routing opinion; you supply the Lambda `code`.\n\n```ts\nimport { CrewWebhookIngress } from '@raindancers/raindancers-crew';\nimport * as lambda from 'aws-cdk-lib/aws-lambda';\n\nnew CrewWebhookIngress(this, 'Webhook', {\n  vpc,\n  host,                               // the EcsCrewHost above\n  permissionsBoundaryArn: '...',\n  code: lambda.Code.fromAsset('path/to/ingress-lambda'),\n});\n```\n\n## Backing up the crew's learnings\n\nA remote crew's value is its accumulated memory, lessons, and knowledge — which on the EC2 lane live on the instance's local disk. KiroCrew's built-in backup (`kirocrew snapshot`) produces a redaction-scrubbed bundle (the signing key, `.env`, and execution logs never ship), but writes it **locally** — so it survives corruption, not instance loss. These constructs add the missing **off-box durability**.\n\n`CrewBackupBucket` provisions a hardened destination: SSE-KMS (rotating key), all public access blocked, TLS-only, **versioned**, with a lifecycle rule expiring stale noncurrent versions. Bucket and key `RETAIN` on stack delete, so the backups outlive a teardown.\n\n```ts\nimport { CrewBackupBucket, RemoteCrewInstance } from '@raindancers/raindancers-crew';\n\nconst backup = new CrewBackupBucket(this, 'CrewBackup');\n\nnew RemoteCrewInstance(this, 'Crew', {\n  vpc,\n  permissionsBoundaryArn: '...',\n  backupBucket: backup,          // grants scoped write + installs a daily timer\n  backupSchedule: 'daily',       // systemd OnCalendar\n});\n```\n\nOn the **EC2 lane** this grants the instance role scoped write, installs a **systemd timer** that runs `kirocrew snapshot --purpose backup` and uploads the newest bundle to S3 (a timestamped key for history plus a stable `latest.tar`), and installs a `kirocrew-restore-from-s3` helper. On the **Fargate lane**, pass the same bucket to `FargateCrew` — it grants the **task role** (the running container) write, since the container runs its own snapshot push.\n\n### Restore (rebuilding a replacement crew)\n\n`kirocrew restore <bundle> --mode replace|merge`:\n\n- **replace** clears the target's memory/knowledge trees and rebuilds them from the bundle (the knowledge DB and memory stores are replaced wholesale, not row-merged). Restore validates database integrity and refuses a truncated bundle; `sel_hmac.key` is regenerated (not restored). Use on a fresh replacement instance.\n- **merge** layers the bundle onto existing state without clearing. Use to seed a crew you want to keep.\n\nOn an EC2 instance provisioned with a backup bucket, `sudo kirocrew-restore-from-s3` pulls `latest.tar`, stops the gateway, restores in **replace** mode, and restarts — a one-command rebuild.\n\n## License\n\nApache-2.0\n"
   },
   "repository": {
     "type": "git",
@@ -9278,6 +9278,89 @@
       ],
       "symbolId": "src/crew-backup-bucket:CrewBackupBucketProps"
     },
+    "@raindancers/raindancers-crew.CrewDataVolume": {
+      "assembly": "@raindancers/raindancers-crew",
+      "datatype": true,
+      "docs": {
+        "remarks": "The device name the construct asks for (for example `/dev/sdf`) is NOT the\nkernel device name on Nitro/Graviton, where every EBS volume surfaces as an\nunpredictable `/dev/nvmeXn1`. The bootstrap therefore resolves each volume by\na stable filesystem LABEL, never by the device path.",
+        "stability": "stable",
+        "summary": "How a per-crew durable EBS volume is exposed to the host and its container."
+      },
+      "fqn": "@raindancers/raindancers-crew.CrewDataVolume",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/ecs-crew-host.ts",
+        "line": 32
+      },
+      "name": "CrewDataVolume",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The crew this volume belongs to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 34
+          },
+          "name": "crew",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The block device name requested at attach time (a hint, not the kernel name)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 36
+          },
+          "name": "deviceName",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The stable filesystem label the bootstrap resolves and mounts by."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 38
+          },
+          "name": "label",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "stable",
+            "summary": "The host mount path the container bind-mounts for `~/.kiro/crew`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 40
+          },
+          "name": "mountPath",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/ecs-crew-host:CrewDataVolume"
+    },
     "@raindancers/raindancers-crew.CrewRuntime": {
       "assembly": "@raindancers/raindancers-crew",
       "datatype": true,
@@ -9428,6 +9511,946 @@
       ],
       "symbolId": "src/remote-crew-instance-props:CrewSource"
     },
+    "@raindancers/raindancers-crew.CrewWebhookIngress": {
+      "assembly": "@raindancers/raindancers-crew",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "Nothing is created unless the\nconsumer instantiates it, so an existing consumer gains no new resources.\n\nBecause each crew task runs in awsvpc mode with a real private VPC IP, an\nin-VPC Lambda can POST to a crew's `POST /api/hooks/agent` DIRECTLY — no VPC\nendpoint, no PrivateLink, no ALB. This construct wires: an SNS topic, an\nin-VPC Lambda under the permissions boundary, and a scoped ingress rule on\nthe crew task security group from the Lambda's SG on the crew port ONLY.\nThat ingress rule is the single controlled inbound exception to the\negress-only task model.\n\nGreenfield: the construct wires the plumbing but ships no webhook-to-crew\nrouting opinion — the consumer supplies the Lambda {@link CrewWebhookIngressProps.code}.",
+        "stability": "stable",
+        "summary": "OPTIONAL, composable webhook-ingress path for {@link EcsCrewHost}, mirroring the optional {@link CrewBackupBucket } shape."
+      },
+      "fqn": "@raindancers/raindancers-crew.CrewWebhookIngress",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/crew-webhook-ingress.ts",
+          "line": 120
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@raindancers/raindancers-crew.CrewWebhookIngressProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/crew-webhook-ingress.ts",
+        "line": 112
+      },
+      "name": "CrewWebhookIngress",
+      "properties": [
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The in-VPC ingress Lambda."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 116
+          },
+          "name": "function",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Function"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The ingress Lambda's security group (the source of the scoped task ingress rule)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 118
+          },
+          "name": "securityGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SecurityGroup"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The SNS topic that fans events into the ingress Lambda."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 114
+          },
+          "name": "topic",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_sns.ITopic"
+          }
+        }
+      ],
+      "symbolId": "src/crew-webhook-ingress:CrewWebhookIngress"
+    },
+    "@raindancers/raindancers-crew.CrewWebhookIngressProps": {
+      "assembly": "@raindancers/raindancers-crew",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Properties for {@link CrewWebhookIngress}."
+      },
+      "fqn": "@raindancers/raindancers-crew.CrewWebhookIngressProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/crew-webhook-ingress.ts",
+        "line": 15
+      },
+      "name": "CrewWebhookIngressProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The consumer supplies it: this construct\nwires the plumbing (SNS -> in-VPC Lambda -> task private IP) but does not\nship an opinion about how a webhook payload maps to a crew.",
+            "stability": "stable",
+            "summary": "The code the ingress Lambda runs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 42
+          },
+          "name": "code",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Code"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The task security group is\ngranted a scoped inbound rule from this ingress Lambda's SG on the crew\nport only — the one controlled inbound exception to the egress-only model.",
+            "stability": "stable",
+            "summary": "The crew host whose tasks receive webhooks."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 28
+          },
+          "name": "host",
+          "type": {
+            "fqn": "@raindancers/raindancers-crew.EcsCrewHost"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The ingress Lambda runs consumer-triggered code, so it carries a boundary\nmatching the rest of the construct.",
+            "stability": "stable",
+            "summary": "ARN of an IAM permissions boundary applied to the Lambda's execution role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 35
+          },
+          "name": "permissionsBoundaryArn",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Must be the same VPC as the crew tasks\nso the Lambda can reach a task's private ENI IP directly with NO VPC\nendpoint.",
+            "stability": "stable",
+            "summary": "VPC to place the ingress Lambda in."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 21
+          },
+          "name": "vpc",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "lambda.Architecture.ARM_64",
+            "remarks": "Defaults to arm64 to match the Graviton host.",
+            "stability": "stable",
+            "summary": "Lambda architecture."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 64
+          },
+          "name": "architecture",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Architecture"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "5476",
+            "stability": "stable",
+            "summary": "TCP port on the crew task the Lambda reaches (the gateway/webhook port)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 79
+          },
+          "name": "crewPort",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'index.handler'",
+            "stability": "stable",
+            "summary": "The Lambda handler entry point."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 49
+          },
+          "name": "handler",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "lambda.Runtime.NODEJS_20_X",
+            "remarks": "Must be an arm64-compatible runtime to match the\narm64 default host.",
+            "stability": "stable",
+            "summary": "The Lambda runtime."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 57
+          },
+          "name": "runtime",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_lambda.Runtime"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "Duration.seconds(30)",
+            "stability": "stable",
+            "summary": "Lambda timeout."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 93
+          },
+          "name": "timeout",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.Duration"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- a new topic is created",
+            "remarks": "Omit to create one.",
+            "stability": "stable",
+            "summary": "An existing SNS topic to subscribe the Lambda to."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 86
+          },
+          "name": "topic",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_sns.ITopic"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the VPC's private-with-egress subnets",
+            "remarks": "Should be the same private\nsubnet the crew tasks run in so the Lambda reaches task IPs directly.",
+            "stability": "stable",
+            "summary": "Subnets to place the ingress Lambda's ENIs in."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/crew-webhook-ingress.ts",
+            "line": 72
+          },
+          "name": "vpcSubnets",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
+          }
+        }
+      ],
+      "symbolId": "src/crew-webhook-ingress:CrewWebhookIngressProps"
+    },
+    "@raindancers/raindancers-crew.EcsCrewHost": {
+      "assembly": "@raindancers/raindancers-crew",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "The host registers to the {@link FargateCrewBase} cluster and does the NAT\nfor the crew tasks itself, so the tasks stay fully private with no public\nIPs and no NAT Gateway, fck-nat, VPC endpoints, or ALB. Each task runs in\nawsvpc mode with its own ENI and private VPC IP; each crew keeps its durable\n`~/.kiro/crew` state on its own encrypted EBS volume that survives instance\nreplacement.\n\nIsolation is container-level (shared kernel), accepted as sufficient:\nGraviton Nitro protects the box from other AWS tenants, containers cover\ncrew-to-crew separation. See the host-OOM caution: hard per-task memory caps\nbound each crew's ceiling but a busy crew can still pressure siblings when\nthe sum of actual usage exceeds physical RAM.\n\n`crewCount` defaults to 1, identical to the single-crew shape, so a plain\ninstantiation with no new props gains no extra resources.",
+        "stability": "stable",
+        "summary": "One self-provisioned EC2 host running the ECS agent, hosting `crewCount` Kiro Crew instances as ECS-on-EC2 container tasks."
+      },
+      "fqn": "@raindancers/raindancers-crew.EcsCrewHost",
+      "initializer": {
+        "docs": {
+          "stability": "stable"
+        },
+        "locationInModule": {
+          "filename": "src/ecs-crew-host.ts",
+          "line": 281
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@raindancers/raindancers-crew.EcsCrewHostProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/ecs-crew-host.ts",
+        "line": 259
+      },
+      "name": "EcsCrewHost",
+      "properties": [
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The size-1 Auto Scaling Group holding the single ECS-registered EC2 host."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 263
+          },
+          "name": "autoScalingGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_autoscaling.AutoScalingGroup"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The shared ECS scaffolding (cluster + egress-only task SG)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 261
+          },
+          "name": "base",
+          "type": {
+            "fqn": "@raindancers/raindancers-crew.FargateCrewBase"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The capacity provider registering the host with the cluster."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 265
+          },
+          "name": "capacityProvider",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecs.AsgCapacityProvider"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The resolved crew names."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 279
+          },
+          "name": "crewNames",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The per-crew scaffolding (roles + log group), one per crew."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 271
+          },
+          "name": "crews",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@raindancers/raindancers-crew.FargateCrew"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The per-crew durable data volumes (device/label/mount metadata)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 275
+          },
+          "name": "dataVolumes",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@raindancers/raindancers-crew.CrewDataVolume"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The host's SSM-only security group (no inbound)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 269
+          },
+          "name": "hostSecurityGroup",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SecurityGroup"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The region the host runs in (read from the stack env, never a prop)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 574
+          },
+          "name": "region",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The host instance's IAM role (carries the permissions boundary)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 267
+          },
+          "name": "role",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_iam.Role"
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The per-crew EC2 services."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 273
+          },
+          "name": "services",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "aws-cdk-lib.aws_ecs.Ec2Service"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "stable",
+            "summary": "The discovery tag value written as `kirocrew:ecs-host`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 277
+          },
+          "name": "stackTag",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/ecs-crew-host:EcsCrewHost"
+    },
+    "@raindancers/raindancers-crew.EcsCrewHostProps": {
+      "assembly": "@raindancers/raindancers-crew",
+      "datatype": true,
+      "docs": {
+        "stability": "stable",
+        "summary": "Properties for {@link EcsCrewHost}."
+      },
+      "fqn": "@raindancers/raindancers-crew.EcsCrewHostProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/ecs-crew-host.ts",
+        "line": 46
+      },
+      "name": "EcsCrewHostProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The host runs a prompt-injectable agent per crew, so its role MUST carry a\nboundary that caps blast radius. Required, not optional, matching\n{@link RemoteCrewInstanceProps.permissionsBoundaryArn }. Any valid managed-\npolicy ARN is accepted here (this is the EC2/host boundary).\n\nThe per-crew task/execution roles take {@link crewPermissionsBoundaryArn},\nwhich is validated separately against the `kirocrew-crew-boundary` pattern\nthe crew roles require.",
+            "stability": "stable",
+            "summary": "ARN of an IAM permissions boundary applied to the host instance role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 69
+          },
+          "name": "permissionsBoundaryArn",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "The construct consumes a two-subnet host-NAT topology it does not build:\none PUBLIC subnet (host ENI + Elastic IP + IGW route) and one PRIVATE\nsubnet (task ENIs, `0.0.0.0/0` -> the host ENI, no IGW route). Select them\nwith {@link hostSubnets} and {@link taskSubnets}.",
+            "stability": "stable",
+            "summary": "VPC to run in. Passed in, never created here."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 55
+          },
+          "name": "vpc",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "CrewArchitecture.ARM64",
+            "remarks": "Must match\n{@link instanceType} when that is set.",
+            "stability": "stable",
+            "summary": "CPU architecture of the host and the crew container images."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 103
+          },
+          "name": "architecture",
+          "optional": true,
+          "type": {
+            "fqn": "@raindancers/raindancers-crew.CrewArchitecture"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no off-box backup",
+            "remarks": "When set, each per-crew TASK role is granted write so\nthe running container pushes its own snapshots off-box.",
+            "stability": "stable",
+            "summary": "An S3 backup bucket."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 228
+          },
+          "name": "backupBucket",
+          "optional": true,
+          "type": {
+            "fqn": "@raindancers/raindancers-crew.ICrewBackupBucket"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "1",
+            "remarks": "DEFAULT 1 — identical to today's single-crew behaviour, so existing\nconsumers gain nothing new. The 55minutes consumer passes 3. Validated\n1..8: awsvpc gives each task its own ENI, and (crewCount + 1) ENIs (the\nhost ENI plus one per task) must fit the instance type's ENI budget.",
+            "stability": "stable",
+            "summary": "Number of Kiro Crew instances to host, each one ECS task/service."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 115
+          },
+          "name": "crewCount",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- unset (shared CPU)",
+            "remarks": "Omit to\nleave CPU unconstrained (crews share the host CPU fairly under contention).",
+            "stability": "stable",
+            "summary": "Optional SOFT CPU shares per crew container (1024 = one vCPU)."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 194
+          },
+          "name": "crewCpuShares",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "20",
+            "remarks": "Always encrypted, always\n`deleteOnTermination: false` (a crew's `~/.kiro/crew` learnings must\noutlive an instance replacement, matching the CrewBackupBucket RETAIN\nintent).",
+            "stability": "stable",
+            "summary": "Per-crew durable EBS data volume size in GiB."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 160
+          },
+          "name": "crewDataVolumeSizeGb",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "ec2.EbsDeviceVolumeType.GP3",
+            "stability": "stable",
+            "summary": "Per-crew EBS volume type."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 167
+          },
+          "name": "crewDataVolumeType",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.EbsDeviceVolumeType"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'public.ecr.aws/kirocrew/crew:latest'",
+            "remarks": "When {@link ecrRepositoryArn}\nis set this is typically the repo URI with a tag; otherwise a public\nregistry reference.",
+            "stability": "stable",
+            "summary": "Container image reference for the crew task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 212
+          },
+          "name": "crewImage",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "2048",
+            "remarks": "A crew is OOM-killed at this\nceiling, so no single crew can consume the whole host. Set the SUM of hard\ncaps at or below (physical RAM minus host + ECS-agent headroom) for a hard\ncross-crew guarantee — see the host-OOM caution in the README.",
+            "stability": "stable",
+            "summary": "HARD memory cap (MiB) per crew container."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 186
+          },
+          "name": "crewMemoryHardLimitMiB",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "1024",
+            "remarks": "ECS uses it for\nplacement; a crew may burst above it when the host has spare RAM, so idle\ncrews cost little.",
+            "stability": "stable",
+            "summary": "SOFT memory reservation (MiB) per crew container."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 176
+          },
+          "name": "crewMemoryReservationMiB",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- no crew boundary (declared degraded mode; see FargateCrew)",
+            "remarks": "Separate from {@link permissionsBoundaryArn} because the crew roles enforce\nthe `kirocrew-crew-boundary` policy name (a different boundary from the\nhost's), and validating them together would force one ARN to satisfy two\ndistinct patterns. Optional, mirroring {@link FargateCrew}'s declared\ndegraded mode: omit it only when no crew-boundary creator exists yet.",
+            "stability": "stable",
+            "summary": "ARN of the pre-created shared crew permissions boundary (`arn:aws:iam::<account>:policy/kirocrew-crew-boundary`), applied to every per-crew task and execution role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 84
+          },
+          "name": "crewPermissionsBoundaryArn",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- crew-1 .. crew-<crewCount>",
+            "remarks": "Each must match the {@link FargateCrew} regex\n`^[a-z0-9]([a-z0-9-]{0,30}[a-z0-9])?$`; the log group, roles, and secret\nnamespace are derived from it. When omitted, names are generated as\n`crew-1`..`crew-<crewCount>`. When set, the list length must equal\n{@link crewCount}.",
+            "stability": "stable",
+            "summary": "Explicit crew names."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 126
+          },
+          "name": "crews",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- public registry; no pull grant",
+            "remarks": "Leave unset when\nthe image is pulled from a public registry. When set, each per-crew\nexecution role gets a pull grant scoped to this one repository.",
+            "stability": "stable",
+            "summary": "ARN of the private ECR repository holding the crew image."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 203
+          },
+          "name": "ecrRepositoryArn",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- one public subnet in the VPC",
+            "remarks": "This is the PUBLIC subnet (IGW-routed,\ncarries the Elastic IP), because the host does the NAT for the tasks.",
+            "stability": "stable",
+            "summary": "Subnet selection for the host ENI."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 134
+          },
+          "name": "hostSubnets",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- m7g.2xlarge (arm64) / m7i.2xlarge (x86_64), matching\nRemoteCrewInstance",
+            "remarks": "The type STAYS a settable prop: the 55minutes consumer passes\n`new ec2.InstanceType('m9g.xlarge')`. Never hardcoded to one family.",
+            "stability": "stable",
+            "summary": "EC2 instance type for the single ECS-registered host."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 95
+          },
+          "name": "instanceType",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.InstanceType"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "30",
+            "remarks": "One of the CloudWatch retention values\n(see {@link FargateCrew}).",
+            "stability": "stable",
+            "summary": "Days a crew's task logs are kept."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 220
+          },
+          "name": "logRetentionDays",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "60",
+            "remarks": "Always encrypted.",
+            "stability": "stable",
+            "summary": "gp3 root volume size in GiB for the host."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 150
+          },
+          "name": "rootVolumeSizeGb",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'kirocrew'",
+            "remarks": "Must match\n`[a-zA-Z0-9-]{1,51}`. The cluster is named `kirocrew-crew-<stackTag>`.",
+            "stability": "stable",
+            "summary": "Discovery tag value written as `kirocrew:ecs-host`."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 236
+          },
+          "name": "stackTag",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "- the VPC's private-with-egress subnets",
+            "remarks": "This is the PRIVATE subnet whose\n`0.0.0.0/0` route points at the host ENI (no IGW route). Tasks get no\npublic IP.",
+            "stability": "stable",
+            "summary": "Subnet selection for the crew task ENIs."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/ecs-crew-host.ts",
+            "line": 143
+          },
+          "name": "taskSubnets",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
+          }
+        }
+      ],
+      "symbolId": "src/ecs-crew-host:EcsCrewHostProps"
+    },
     "@raindancers/raindancers-crew.FargateCpuArchitecture": {
       "assembly": "@raindancers/raindancers-crew",
       "docs": {
@@ -10547,6 +11570,6 @@
       "symbolId": "src/remote-crew-instance-props:WebhookIngress"
     }
   },
-  "version": "0.0.0",
-  "fingerprint": "JRWjMnQR6Rgpu44DGKaesJ6Hzo4p6lBXKvvFKdC2oBM="
+  "version": "0.0.2",
+  "fingerprint": "jT4lYbBvDKoB3fC/KVbUZT6Zqj04ZkPfUJHktccnGYM="
 }